Some SAML 1 flow questions

[Cantor, Scott]

On 2/4/14, 11:56 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:
>
>This leads into an "enquiring minds want to know" question that I have
>been
>mulling over recently.  How are we going to handle the Attribute Push vs
>Attribute Pull vs Artefact configuration (OK, so artefact isn't
>configuration but it is a wrinkle at the end of the SSO flow).

Pull vs. query is presumably a flag on the profile config as it is now,
which is checked by the AddAttributeStatement action.

Artifact I haven't really looked at, but Brent highlighted some of the
issues there in the write up.

>It seems obvious that one could handle this by just having completely
>different SSO flows which either have or do not have the required Actions,
>but that seems heavyweight so I am assuming that there is some design
>which
>allows this to be decided on the fly (maybe in sub flow as we do for
>C14N).

No, it's not separate flows, no way.

>And as a related question, ISTR that in V2 we resolve Attributes during
>SSO,
>even if we are not going to push them, then when we get an attribute query
>we do the whole thing again.  Whilst (AIUI) you need to do this if you are
>returning an artefact which references an Assertion with Attributes, I'm
>guessing that it is not needed in this case and we can avoid it?

No, we do it all the time now because that's where the data for most
NameID values comes from. I haven't considered whether that's feasible to
bypass in V3. It would be nice, but it's not worth spending a lot of time
on because the query case is receding into the minority right now, and
caching makes it largely a non-problem.

Whether OpenID might change that later, I couldn't say, but if there's
strictly no reason to run the resolver, that's not hard to bypass.

-- Scott