Hello Descope Team, We are currently configuring SAML SSO using Descope as the Identity Provider (IdP) and Workforce Junction as the Service Provider (SP). Setup details: • We created a Federated App (SAML) in Descope. • After configuration, we downloaded the SAML certificate and shared it with the Workforce Junction team. • They have installed the certificate and completed their SP-side configuration. Issue: During testing, even when a user has a valid active session in Lumber (Descope session exists), initiating SSO redirects the user to log in again instead of reusing the existing session. Our expected behavior is: 1. User logs into Lumber via Descope Flow. 2. A valid Descope session is created. 3. When we call the SAML SSO URL, the existing session should be reused. 4. User should be redirected to login in lumber. Could you please help us verify: • Whether we are missing any required configuration? • If there are specific settings needed to ensure session reuse? • Whether additional parameters or configuration are required for SAML IdP-initiated or SP-initiated flows? Please let us know if configuration details missing from our side.

Hey @Esakkipandi Esakkimuthu Thanks for reaching out, Let me check the details and get back to you.

@Aditya ArakalI confirmed that the session cookie is valid. We also turned off ForceAuthn (set to false), but we are still facing the same issue.

Are you working with cname? The cookie is saved only when using cname. This is how browser works.

@Esakkipandi Esakkimuthu plz update

@Doron Sharon I would like to confirm whether configuring a Federated Apps (SAML application) is the correct approach, or if any changes are required.

What is the use case?

@Doron Sharon We are working on building SSO integration between Lumber and Benefits Junction. In this setup: • Lumber will act as the Identity Provider (IdP). • Benefits Junction will act as the Service Provider (SP). When a user clicks the Benefits Junction button in the Lumber application, we will initiate the Descope SAML flow. The user will be authenticated and validated, and upon successful verification, they will be redirected to the Benefits Junction page. Integration Steps: 1. Lumber must configure SAML in their system. 2. Lumber must generate and share the SAML certificate with WFJ. 3. WFJ must install the certificate on the Benefits Junction server to complete the trust configuration. Once these steps are completed, the SSO flow should function as expected.

Yes, this is a simple IdP to SP SSO, did you see any error? The problem that the session is not kept is because you need to have custom domain defined and use it.

@Doron Sharon I am not receiving any error. However, every time we initiate SSO, it forces the user to log in again. How can we resolve this? How should we properly handle the session so that users are not prompted to log in each time SSO is initiated?

As I wrote, you need to have custom domain for the browser to store the cookie

Do you have any documentation?

Thanks.