Requesting new Assertion to STS

[Gina Choi]

>IsPassive has nothing to do with it. If you're using SAML protocol, then
>you can refer to the SAML profiles and specifications to understand how to
>do things. If not, you're not using anything standard and there are no
>answers to your questions that don't amount to "make it up as you go
>along".

I looked at SAML V2.0 Holder-of-Key Assertion Profile and SAML V2.0 Condition
for Delegation document, but I still can't figure out. Could you specify
profile name that I need to look at? I need to get an assertion token
corresponding to Relying Party B from Service Provider A and the assertion
token must contain AttributeStatement.


>You don't need the Subject element in an AuthnRequest, it has nothing much
>to do with moving between SPs. The identity of the client is deduced from
>the authentication performed to the IdP by the client.

If I do not specify Subject element, how does STS know about which user am I
talking about? How do I specify target relying party B in AuthnRequest? I
could think about three places to specify relying party B. Issuer,
AssertionConsumerServiceURL and Audience, but none of them seems right.

Thanks.
Gina
------------------------------

Message: 5
Date: Tue, 20 Mar 2012 23:41:13 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: Re: Requesting new Assertion to STS
To: Shib Dev <dev at shibboleth.net>
Message-ID: <CB8E8C0D.16CD6%cantor.2 at osu.edu>
Content-Type: text/plain; charset="us-ascii"

On 3/20/12 6:48 PM, "Gina Choi" <gchoi at sdl.com> wrote:
>
>This is what I try to achieve. The SP already logged the user in and is
>requesting a new assertion to STS but corresponding to another Relying
>Party
>in STS. Is this possible with passive AuthnRequest? I read following link
>and
>it is pretty close to what I want to do.
>http://lists.oasis-open.org/archives/saml-dev/200605/msg00051.html

IsPassive has nothing to do with it. If you're using SAML protocol, then
you can refer to the SAML profiles and specifications to understand how to
do things. If not, you're not using anything standard and there are no
answers to your questions that don't amount to "make it up as you go
along".

>I am working with a guy on the same project, but he is on .NET side and he
>seems build everything real quickly using WIF and WCF. On .NET side, they
>are
>getting bootstrap token, but I think that it is a Microsoft term.

That's quite easy to do when they make it all up as they go along and
ignore most of the specs, including the ones they wrote.

>I am trying to figure out if I need to improve my AuthnRequest to get
>assertion token that I needed.

You don't need the Subject element in an AuthnRequest, it has nothing much
to do with moving between SPs. The identity of the client is deduced from
the authentication performed to the IdP by the client.

-- Scott