Hi,

I'm new to SAML and I have two - hopefully not too silly - questions:

(Question 1)

I understood from the profiles in the standard that when requesting an assertion the relying party (server) never contacts the SAML authority (identity provider) directly but only via the user (client), e.g. by redirect.

My question: Is it also possible that the server contacts the SAML authority directly to request an assertion?

- If not, why not?

- If yes, where can I find this variation in the standard?

(Question 2)

If we assume that the server S1 received from the client C an assertion, claiming that it is indeed client C - isn't the following attack possible:

Now S1 acts as a client and claims to server S2 that it is client C and sends to server S2 the assertion that it received from the real C before - and this assertions proofs that S2 is C.

Thank you!