In response to your specific questions:
1.) What is the “ID” value supposed to be?
- This should be a unique identifier for the SAML request. The SAML 2.0 specification states that it’s really implementation specific how this is done, but makes the following recommendations:
The mechanism by which a SAML system entity ensures that the
identifier is unique is left to the implementation. In the case that a
random or pseudorandom technique is employed, the probability of two
randomly chosen identifiers being identical MUST be less than or equal
to 2 ^ -128 and SHOULD be less than or equal to 2 ^-160 in length.
This requirement MAY be met by encoding a randomly chosen value
between 128 and 160 bits in length.
2.) How does the IdP know about you?
- Your SP needs to be registered with the IdP. To accomplish this, the SAML specification defines a format for “SAML Metadata” which tells the IdP where your SAML receivers are, what your certificates are, attributes you exchange, etc. OpenAM likely dictates some minimum requirements for configuring a trusted SP. This varies in each product.
3.) Where’s the Response go, and what to check?
- The Response will go to your Assertion Consumer Service (ACS) URL usually defined in the SAML Metadata you exchange from your SP with the IdP for initial setup. When you receive a SAML Response, you need to check many things – but most importantly, the SAML Status code should be “success”, the inResponseTo ID’s should match the request’s sent ones and you must validate the digital signature on the Assertion. For that, you’ll need to trust the IdP’s public verification certificate, and you’ll probably also want to do revocation checking.
4.) What about Logout?
- SAML 2.0 also defines a profile for Single LogOut (SLO). This will not only log you out of the SP, but also the IdP and potentially any other SP’s you’ve established a session with. It has a similar request/response flow as Single Sign-On (SSO), and thus similar things to set up and check (status codes, signatures, etc.).
So in short – this can be quite complex to implement from scratch. It’s best to use tried & true libraries and/or products like Ian suggests. Companies like his have invested hundreds of hours of developer time to implement according to the spec and test interoperability with other vendors.