How does the HTTP Artifact binding work together with the Artifact Resolution Protocol, and when is it used?

Instead of the message, the browser carries only a short reference (the artifact); the receiver then fetches the real message directly from the sender over a SOAP back channel. It is used when message size matters or when the message must not pass through the browser.

* Artifact binding: only a reference crosses the browser; the assertion travels server to server. *

1. After authenticating the user, the IdP stores the <Response> and sends the browser to the SP with a short, opaque artifact in the URL or a form.
2. The SP reads the artifact. Its format lets the SP identify which IdP issued it (a SourceID derived from the IdP's entity ID).
3. The SP sends an <ArtifactResolve> over SOAP directly to the IdP (mutually authenticated).
4. The IdP returns an <ArtifactResponse> containing the real message, and the artifact becomes invalid.

Why bother? The assertion never touches the browser, so a script in the page or a malicious extension cannot read it, and huge messages avoid URL and form limits. The price is a direct network connection between SP and IdP and one more round trip.

Go deeper:

• SAML 2.0: HTTP Artifact Binding (Wikipedia) — the artifact format and a full exchange.
• SAML 2.0: Artifact Resolution Protocol (Wikipedia) — the ArtifactResolve and ArtifactResponse messages.