attaching assertion to a link to another sp?

[Cantor, Scott]

On 8/22/13 10:51 AM, "Gene Matthews" <gmatthew at hitachi-cta.com> wrote:

>We will have two different sp's talking to our Idp. They way the system
>is being specified, users will always start at protected resources behind
>sp1 and at some point may click a link that will take them to a protected
>resource at sp2.  Assuming sp1 successfully
> receives a security assertion from our Idp, when the use clicks a link
>that will take them to a resource at sp2, sp1 should attach that
>assertion somehow to the link to sp2, I'm thinking. Then sp2 will
>communicate with our Idp to verify session is still valid
> for the user.

No, that's not how SAML SSO works. The assertion for SP1 is only for SP1,
cannot be validated in any other context, and is not meant to be passed to
any other system. There are ways around that, but they are not needed to
make basic SSO work, that's handled by the IdP directly.

>- does my description in the first paragraph sound reasonable and
>implementable with shibboleth-sp and shibboleth-idp?

Not in any way.

>- can sp1 attach the security assertion it received from the Idp to the
>link over to sp2?

No, you should not and cannot anyway, there is no way to do that in HTTP.

-- Scott