IdPv3 CAS Protocol Update

[Cantor, Scott]

On 4/2/13 10:35 AM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>Only the ticket request portion of the CAS protocol is implemented,
>but it's enough to get a feel for how integration would look and
>initial signs are promising. The biggest obstacle at present is
>determining how to interact with the Shib authentication flow. I
>imagine it will be a subflow call, and I've modeled as such, but the
>details are unclear. I not only need to call the flow but pass context
>parameters that indicate forced authentication is required under some
>conditions. Any suggestions or recommendations for interacting with
>the authn flow?

Yeah, the way this is meant to work is via subcontexts in the tree. There
would be an action that would extract information from the request that
needs to be accessible later on, probably some kind of
AuthenticationRequirementsContext. I don't think we have anything actually
defined on that, but I didn't actually look.

One of the things we talked about in Columbus was the idea of whether to
try and collapse common pieces across protocols into one context type
(like basic message metadata such as issuer, timestamp, etc.) or leave
them protocol-specific. One of the places keeping them separate falls down
is anything that needs to be known to the authentication layer. I'm not
sure keeping them separate works in this particular case.

-- Scott