Is it allowed to send SOAP <AuthnRequest> message?

[Yaowen Tu <yaowen.tu@gmail.com>]

Hi,

I am trying to see if the following scenario is valid or not.

1) I am implementing an SP, and in one case, the SP can get username and password directly.

2) Suppose IdP support SOAP binding for <SingleSignOnService>.

3) Then can SP simply send a SOAP message to the IdP's SOAP binding end point including username and password

4) Then IdP return an <Assertion>.

Is that a valid scenario?

Also in step (3), is it allowed for IdP to support SOAP binding for <SingleSignOnService>?


You help is highly appreciated.

Best,
Yaowen