title: Reasons to choose SP-Initiated or IDP-Initiated SSO
body: <p>In my understanding of SP-init and IDP-init SSO is as follow:</p>
  
  <p>IDP-init SSO: A base64-encoded saml response is generated by IDP and send to SP, SP then verifies the response and finally the user is logged into the application if the response is valid.</p>
  
  <p>SP-init SSO: A saml request is sent from SP to IDP, then IDP will authenticate the user then send back the saml response, the next part is same as IDP-init SSO. </p>
  
  <p>How do we decide to choose whether the SSO is using SP-init or IDP-init ? SP-init seems to be more secure and reliable than IDP-init SSO because of the authentication part.</p>