During the authentication process while accessing a private web application, how is the SAML assertion delivered to the service provider?

During SAML 2.0 Web Browser SSO authentication for accessing private applications via Zscaler Private Access (ZPA), the user is first redirected to the SAML Identity Provider (IdP) for credential verification. Once authenticated, the IdP generates an HTML document containing an embedded SAML assertion and an automated JavaScript form. The user's web browser processes this document and automatically performs a Form POST request to the Assertion Consumer Service (ACS) endpoint of the Service Provider (SP). This standard HTTP POST mechanism securely delivers the SAML assertion payload directly from the client browser to the SP without requiring direct back-channel API connections between the IdP and SP.

A. HTTP Redirect is used to send the user from the SP to the IdP, but cannot carry large SAML assertions due to URL length restrictions.

B. SAML browser SSO relies on front-channel browser redirects and HTTP POST requests rather than direct back-channel API request/response sequences between systems.

C. While Zscaler Client Connector facilitates transport, standard SAML assertions in web application SSO are delivered to the SP via the browser's HTTP Form POST.

1. OASIS SAML v2.0 Standard: "Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0", Section 3.5: Web Browser SSO Profile.

2. Zscaler Private Access (ZPA) Documentation: "SAML Single Sign-On Deployment Guide", Section: SAML Authentication Workflow.