Security Context in SAML 2.0

[giorgi moniava <giorgimoniava@yahoo.com>]

Hi all.

SAML 2.0 document, usually mention a "security context" which a user has with an IdP or an SP.  (e.g. a citation: "The user provides valid credentials and a local logon security context is created for the user at the IdP".) But such documents, never give a recommendation or description on how such "security context" should be created, or maintained.

Can anyone elaborate on this? I can imagine this can be done by using cookies, but are there any other methods? Can the IdP's or SP's simply store assertions, and check the vaildity times inside, in order to determine whether a user has a security context or not?

Best Wishes,
Giorgi.