title: Is this SAML SSO implementation correct?
body: <p>I have a site say <strong>www.e1.com</strong>. <strong>www.e1.com is Service Provider</strong>. Whenever I click a service in it, I am redirected to a <strong>Identity provider, say www.e2.com</strong>. Before that,In service provider(www.e1.com) I will check if any cookie is set for the user. For the first time there will be no cookie so it will send empty SessionId value. Thus, I am sending a SAML Request to www.e2.com along with with no id(as no cookie is set. Cookie contains Id) <br></p>
  
  <p>Now in www.e2.com i.e.In identity provider,I will check whether www.e1.com has sent any Id value. If it is null I will create a session Id and store it in database(In www.e2.com). Then I will redirect browser to my Authentication page where User's Name and password will be asked and accordingly he will be authenticated. If the authentication is successfull, I will redirect browser to Service provider(www.e1.com) with SAML Response which contains session Id. <br></p>
  
  <p><strong>Now in Service provider the SessionId value will be stored in Cookie and browser will be redirected to consumer service page(service page the user wants to access)</strong>.<br><br></p>
  
  <p>Now if the same user wants to access some other service from same Service provider
  (within the session), the browser will obviously send the SessionId in Cookie along with the request SAML. Identity Provider will check the SessionId value in his database, If its there in its database then it will give direct access to service to user without entering login credential as the user is already authenticated for the session.<br><br></p>
  
  <p><strong>Is this the right way to achieve Single Sign On with SAML?</strong> or<br>
  <strong>If this method has flaws, Can you explain those flaws?</strong><br><br>
  <em>Thanks in advance :)</em> </p>