title: Do we need to use cookie for SAML2 login?
body: <p>I'm brand new to the world of SAML-2.
  I've to implement SAML-2 for our web-based product using java.
  My colleague has suggested following solution to implement SAML-2.</p>
  
  <p>I just wanted to discuss whether it make sense... </p>
  
  <p>Scenario A: John logs in for the first time since SSO has been implemented at his company</p>
  
  <ol>
  <li>John points his browser at TMS</li>
  <li>TMS does not find a SAML token stored as a cookie in the request header from John’s browser</li>
  <li>John’s browser is redirected to the standard TMS login page</li>
  <li>John enters his normal windows login credentials and hits ENTER</li>
  <li>TMS successfully authenticates his credentials against his company’s IdP server, which in this case is ADFS using SAML</li>
  <li>The SAML token is returned to TMS and saved in John’s browser as a cookie</li>
  <li>John is now able to use TMS</li>
  </ol>
  
  <p>Scenario B: John wants to use TMS again but has closed his browser</p>
  
  <ol>
  <li>John opens a new instance and points it to TMS</li>
  <li>TMS finds a SAML token stored as a cookie in the request header from John’s browser</li>
  <li>TMS verifies that this token is valid and so John goes straight into TMS bypassing the login page</li>
  </ol>
  
  <p>My question- is this a standard or correct approach? 
  If we use cookie for remembering the SAML token, what if the user clears the cookie or doesn't want to keep cookie? In that case user will be directed to the login page every time...</p>
  
  <p>Is there any resource (ie. book or online tutorial) that I can look into for this specific purpose?</p>
  
  <p>Please let me know your suggestion.</p>