HTTP redirection from user's browser to Orange:

[IDP_SingleSignOnURL]?SAMLRequest=PEF1dGhuUmVxdWVzdCB4
bWxucz1cInVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2Nv
bFwiICBJRD1cIl9jYzgzNGMxODFmYzA0MDhjOTgzY2I1NWY4ZWZlYzI4
OVwiIFZlcnNpb249XCIyLjBcIiBJc3N1ZUluc3RhbnQ9XCIyMDA3LTEyLT
IxVDIwOjI0OjQ3WlwiID48SXNzdWVyIHhtbG5zPVwidXJuOm9hc2lzOm5
hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvblwiPmh0dHA6Ly9teXNwP
C9Jc3N1ZXIPE5hbWVJRFBvbGljeSBGb3JtYXQ9XCJ1cm46b2FzaXM6
bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDpwZXJzaXN0Z
W50XCIgIEFsbG93Q3JlYXRlPVwidHJ1ZVwiLz48L0F1dGhuUmVxdWV
zdD4%3D

Requête SAML décodée :

<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol" ID="_cc834c181fc0408c983cb55f8efec289"
Version="2.0" IssueInstant="2007-12-21T20:24:47Z" >     <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"[SERVICE_ID]</Issuer>
     <NameIDPolicy
          Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"  AllowCreate="true"/>
</AuthnRequest>

<?php
     function randomhex($length)
     {
          $key = "";

          for ( $i=0; $i < $length; $i++ )
          {
               $key .= dechex( rand(0,15) );
          }

          return $key;
     }

      ## Metadata
     require_once("idpMetadata.php");
     $issuer = "[SERVICE_ID]";
     $idpTargetUrl = $idpMetadata['[IDP_ID]']['SingleSignOnUrl'];

     ## Dynamic data of the SAML request
     $id = randomhex(32);
     $issueInstant = gmdate("Y-m-d\TH:i:s\Z");

     ## <AuthnRequest>
          $authnRequest =
               "<AuthnRequest xmlns=\"urn:oasis:names:tc:SAML:2.0:protocol\" " .
               "ID=\"_" . $id . "\" " .
               "Version=\"2.0\" " .
               "IssueInstant=\"" . $issueInstant . "\">\n" .
               "<Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">" .
               $issuer . "</Issuer>\n" .
               "<NameIDPolicy " .
               "Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\" " . 
               "AllowCreate=\"true\"/>" .
     "</AuthnRequest>";

     ## HTTP-Redirect Binding
     $encodedAuthnRequest = urlencode( base64_encode( gzdeflate( $authnRequest ) ));
     $redirectUrl = $idpTargetUrl . "?SAMLRequest=" . $encodedAuthnRequest;

     ## Redirect
     Header("Location: ".$redirectUrl);

?>
"idpMetadata.php" configuration file (used  in previous code example):

<?php
# The partner SP must store the metadata to communicate with Orange identity provider.
    $idpMetadata = array(
     "[IDP_ID]" =>
  array( "SingleSignOnUrl" =>"[IDP_SingleSignOnURL]",
             "certificate" =>"[IDP_Certificate]" )    );
?>

4b124ae2-0126-102b-8852-001a641049bb

Requête SAML décodée :

<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol"
     ID="jw0BhUnqZ5rvjx5UlnLKszkWvZteYg56" Version="2.0"
     IssueInstant="2007-12-21T20:24:51Z"  
     Destination="[SERVICE_RETURN_URL]"  
     InResponseTo="_cc834c181fc0408c983cb55f8efec289">
     <Status>
          <StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
     </Status>
     <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
          ID="EtnKtS6DKwiisFLg5DTEgtt868MccfYI" Version="2.0"
          IssueInstant="2007-12-21T20:24:51Z">
          <Issuer>[IDP_ID]</Issuer>
          <Subject>
        <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
                    4b124ae2-0126-102b-8852-001a641049bb
               </NameID>
        <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData Recipient="[SERVICE_RETURN_URL]" 
                    NotOnOrAfter="2007-12-21T20:39:51Z"
                    InResponseTo="_cc834c181fc0408c983cb55f8efec289"/>
               </SubjectConfirmation>
          </Subject>
          <Conditions>
        <AudienceRestriction><Audience>[SERVICE_ID]</Audience>
               </AudienceRestriction>
          </Conditions>
          <AuthnStatement AuthnInstant="2007-12-21T20:24:51Z">
        <AuthnContext>
                    <AuthnContextClassRef>
                  urn:oasis:names:tc:SAML:2.0:ac:classes:Password
                    </AuthnContextClassRef>
        </AuthnContext>
          </AuthnStatement>
     </Assertion>
</Response>

<?php

 require_once('idpMetadata.php');

function checkSimpleSignature($params, $cert) {
     $samlResponse = @base64_decode( $params['SAMLResponse'] );
     $signature = @base64_decode($params['Signature']);
     $sigAlg = $params['SigAlg'];
     if ((strcmp($sigAlg, "http://www.w3.org/2000/09/xmldsig#dsa-sha1") != 0) &&
          (strcmp($sigAlg, "http://www.w3.org/2000/09/xmldsig#rsa-sha1") != 0)) {
        throw new Exception("Signature algorithm ".$sigAlg." is not supported");
     }
     if ( isset($params['RelayState'] ) ) {
  $signedData = "SAMLResponse=".$samlResponse.
   "&RelayState=".$params['RelayState']."&SigAlg=".$sigAlg;
     } else {
  $signedData = "SAMLResponse=".$samlResponse."&SigAlg=".$sigAlg;
     }
     return (@openssl_verify($signedData, $signature, $cert));
}

# Decode the response
$encodedAuthnResponse = $_POST['SAMLResponse'];
$authnResponse = @base64_decode($encodedAuthnResponse);

# Get some useful data from XML
$xml = simplexml_load_string($authnResponse);
$status = (string)$xml->{'Status'}->{'StatusCode'}['Value'];
if ($status != "urn:oasis:names:tc:SAML:2.0:status:Success") {
     // Can be internal error, authentication failure, …
     //  or the user refused when consent was asked ?
     throw new Exception("Status is not success : ".
    (string)$xml->{'Status'}->{'StatusMessage'});
}
// Technical identifier of the IDP
$idpProvider = (string)$xml->{'Assertion'}->{'Issuer'};
// Federation NameIdentifier to be used as a key to identify the user on SP side
$nameID = (string)$xml->{'Assertion'}->{'Subject'}->{'NameID'};
// Authentication context
$authnContext = (string)$xml->{'Assertion'}->{'AuthnStatement'}->
{'AuthnContext'}->{'AuthnContextClassRef'};
// Validity date of the assertion (to be checked by the SP)
$notOnOrAfter = (string)$xml->{'Assertion'}->{'Subject'}->{'SubjectConfirmation'}
->{'SubjectConfirmationData'}['NotOnOrAfter'];
$recipient = (string)$xml->{'Assertion'}->{'Subject'}->{'SubjectConfirmation'}
->{'SubjectConfirmationData'}['Recipient'];
$audience = (string)$xml->{'Assertion'}
->{'Conditions'}->{'AudienceRestriction'}->{'Audience'};

# Verification of signature
$ret = checkSimpleSignature($_POST, $idpMetadata[$idpProvider]['certificate']);
if ($ret != 1) {
     throw new Exception("Signature is not valid");
}

# Verification of validity of the assertion
// Check the $notOnOrAfter parameter (date MUST not be passed)
if (gmdate('Y-m-d\TH:i:s\Z') > $notOnOrAfter){
     throw new Exception("Authentication failed: validy period expires");
}
// Check the $audience parameter (MUST be equal to the [SERVICE_ID])
if ($audience != "[SERVICE_ID]"){
     throw new Exception("Authentication failed: authencation token was not for [SERVICE_ID] but for " . $audience);
}
// Check the $recipient parameter (MUST be equal to the URL where this response is received)

# Profile attributes (only transmitted at first time access and if authorized by Orange)
$user_info = array();
if ($xml->{'Assertion'}->{'AttributeStatement'} &&
    $xml->{'Assertion'}->{'AttributeStatement'}->{'Attribute'}) {
    foreach ($xml->{'Assertion'}->{'AttributeStatement'}->{'Attribute'} as $attribute) {
 $key = $attribute['Name'];
 $user_info["$key"] = (string)$attribute->{'AttributeValue'};
    }
}

?>

<HTML>
<BODY>
 Signature :  <?php echo $ret ?> <BR>
 Status :  <?php echo $status ?> <BR>
 IDP :  <?php echo $idpProvider ?> <BR>
 NameID : <?php echo $nameID ?> <BR>
 AuthnContext : <?php echo $authnContext ?> <BR>
 NotOnOrAfter : <?php echo $notOnOrAfter ?> <BR>
 Recipient :  <?php echo $recipient ?> <BR>
 Audience :  <?php echo $audience ?> <BR>
<BR>
 Attributes :  <?php var_dump($user_info) ?>

</BODY>
</HTML>