Attributes and forwarding to Relay state

[Cantor, Scott]

On 3/16/12 1:38 PM, "Kantzer, Chris E" <ckantzer at affiniongroup.com> wrote:

>Attributes and forwarding to Relay stateHello,
>Is there a way that an attribute consumed from the saml assertion can be
>added to the request that is forwarded to the url in the relay state?
>The url in the relay state is on a different domain than the sp.

That isn't secure. That would require an additional SSO protocol to secure
the exchange and is up to you to implement if that's what you want.

>Are the attributes added to the session that is created by the sp?  Is
>this session forwarded to the relay state url even if they are on
>separate domains?

The session is bound to a cookie that has to be sent back to the SP on
every protected request. You cannot secure an application with the SP that
lives on a different server from the SP unless you deploy a second
protocol, or use the SP as a reverse proxy.

-- Scott