title: IdP initiated login with ThinkTecture IdentityServer v3
body: <h2>Summary</h2>
  <p>In SAML there is a concept of IdP-inititated login, meaning that the Identifying Party (IdP) can send an unsolicited token to the Relying Party (RP / the consuming application) and the user can be logged in without ever calling out to the IdP.
  I have a scenario where I need to do that but I want ThinkTecture Identity Server v3 to be in the middle as I will be handling my normal auth (as in non-SAML everyday stuff) in there. I cannot do a call out to the SAML IdP for reasons beyond my control.
  What I would like to do is this:</p>
  <p><img src="https://i.stack.imgur.com/n3RhP.png" alt="IdP initiated SSO via Identity Server" /></p>
  <p>I have spent a fair bit of time looking at this and I have also looked at the <a href="http://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin" rel="noreferrer">spec</a> which does talk about initiating login from a third party, but if I understand it correctly, it still starts with the 3rd party directing the user to the RP, which then sends a login request to the IdP (which would be the ThinkTecture Identity Server), which is not really what I need.</p>
  <p>In summary, I don't think OpenID Connect has an equivalent of SAML's IdP-initiated SSO. Is that correct or am I just unable to figure it out or is it that ThinkTecture IdentityServer doesn't support it?</p>
  <h2>More details</h2>
  <ul>
  <li>I have successfully used <a href="https://github.com/KentorIT/authservices" rel="noreferrer">KentorIT's AuthServices OWIN Middleware</a> to implement IdP-initiated SAML SSO directly into a website, not using IdSrv at all.</li>
  <li>I have also integrated Kentor's OWIN Middleware with IdSrv so that my website redirects to IdSrv, which then redirects to the SAML Server where I log in, come back to IdSrv, which then translates the SAML token and sends an OpenID Identity Token back to my website.</li>
  <li>For fun, I have also used Kentor's library to just have an MVC controller which unpacks the SAML token, so if I wanted I could do some manual authentication with that.</li>
  </ul>
  <p>It all works rather beautifully, big thanks to ThinkTecture and to KentorIT. Alas, it all still starts with my website and ends up with a redirect to the SAML server, which I can't do in my scenario for non-technical reasons.</p>
  <h2>Alternative solution</h2>
  <p>I can of course just dispense with IdSrv alltogether in this scenario but I have reasons for having IdSrv in the middle and having all my authentication go via that.
  So my thinking at the moment is to do this flow:</p>
  <ol>
  <li>The SAML Server sends a SAML token to a specific URL on my website.</li>
  <li>My website will re-post that token to the Identity Server as-is. The Identity Server has got the KentorIT OWIN middleware installed so this will simply log the user in to IdSrv, which means IdSrv sets an auth cookie.</li>
  <li>IdSrv does a simple redirect back to another URL on my website and does not include any tokens. So far this has got nothing to do with IdSrv really.</li>
  <li>My website now issues an authentication request to IdSrv</li>
  <li>Because the user is already logged in to IdSrv, IdSrv will immediately respond and redirect the user back to my website with an Identity Token
  <img src="https://i.stack.imgur.com/KiM1L.png" alt="Alternative solution" />
  That is a lot of redirects but it should work.</li>
  </ol>
  <p>Before I start implementing it, can anyone tell me if this is the right way to go about it or am I missing something really obvious?</p>
  <h2>EDIT 1</h2>
  <p>It looks like that idea won't work either. Essentially what I need to do is to use IdP initiated SAML SSO to authenticate to <em>Identity Server</em>, then redirect to the RP and get the RP to redirect to Identity Server with an authentication request. <em>However</em>, as far as I can tell, there is no way to get Identity Server to log in <em>except</em> as part of an RP request. In other words, even though my SAML middleware is happily accepting the unsolicited token, IdSrv ignores the SAML middlewares request to log it in (which I supposed is fair enough).</p>
  <p>So, I think an alternative solution is to write a controller that can validate the SAML token and <em>directly</em> call IdSrv <em>in code running on the same server</em> and tell it to log the user in with a principal I manually construct.</p>
  <p>The (new) question is, <strong>does Identity Server expose a mechanism for me to log a user in, in code, so Identity Server sets the appropriate cookies for the user</strong>?</p>