Requesting new Assertion to STS

[Cantor, Scott]

On 3/20/12 6:48 PM, "Gina Choi" <gchoi at sdl.com> wrote:
>
>This is what I try to achieve. The SP already logged the user in and is
>requesting a new assertion to STS but corresponding to another Relying
>Party
>in STS. Is this possible with passive AuthnRequest? I read following link
>and
>it is pretty close to what I want to do.
>http://lists.oasis-open.org/archives/saml-dev/200605/msg00051.html

IsPassive has nothing to do with it. If you're using SAML protocol, then
you can refer to the SAML profiles and specifications to understand how to
do things. If not, you're not using anything standard and there are no
answers to your questions that don't amount to "make it up as you go
along".

>I am working with a guy on the same project, but he is on .NET side and he
>seems build everything real quickly using WIF and WCF. On .NET side, they
>are
>getting bootstrap token, but I think that it is a Microsoft term.

That's quite easy to do when they make it all up as they go along and
ignore most of the specs, including the ones they wrote.

>I am trying to figure out if I need to improve my AuthnRequest to get
>assertion token that I needed.

You don't need the Subject element in an AuthnRequest, it has nothing much
to do with moving between SPs. The identity of the client is deduced from
the authentication performed to the IdP by the client.

-- Scott