MBW – SAML Path

For app=mbw, the gateway forwards the SAMLResponse directly to MBW ACS.

---

Inputs

• SAMLResponse (required): base64-encoded, signed SAML 2.0 response containing attributes (e.g., memberId, email, groupId, state).
• app (required): must be mbw → /gateway/acs?app=mbw.

What it does

1. Receives SAMLResponse at /gateway/acs?app=mbw.
2. Renders an auto-submit form that posts the same SAMLResponse to MBW ACS: https://dev-mbw-api.newbenefits.com/Saml2/Acs (configurable in appsettings.json).
3. MBW consumes the assertion and signs the member in.

Outcome

• Browser posts to MBW ACS → member lands in MBW (per MBW’s post-login flow).

Notes

• For IdP-initiated dev testing, ensure MBW allows unsolicited responses.
• Issuer/Audience in the assertion must match MBW config.