SSO

[Nate Klingenstein]

Gaurav,

Session initiation can happen in many ways.  The SP is in general the right place to perform session initiation, though.  Ideally, SP1 and SP2 would both publish session initiation locations in their metadata:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sp1.com/shibboleth">

  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:Extensions>
      <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://sp1.com/Shibboleth.sso/Login"/>

...

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sp2.com/shibboleth">

  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:Extensions>
      <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://sp2.com/Shibboleth.sso/Login"/>



When SP1 recognized that the user needed a new session at SP2, it would send the user to the request initiator advertised by SP2 in SP2's metadata.

https://sp2.com/Shibboleth.sso/Login?entityID=https://your.idp/idp/shibboleth

This triggers a chain of redirects that are invisible to the user: SP2 would then send the user to the IdP with an authentication request, and the IdP would check the user's authentication session before using it to mint a fresh assertion for the user for SP2.  The user would deliver the assertion to SP2, which would process the assertion and then redirect the user to the web resource.

I hope this is what you're looking for,
Nate.

On 31 Oct 2012, at 07:18, gaurav sinha <gshcet at gmail.com> wrote:

> Does that mean, from sp1.com I will not send a request to sp2.com directly,
> instead I will send a request to IDP which will then redirect to sp2.com ? 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121031/dc7b34fc/attachment-0001.html