attaching assertion to a link to another sp?

[David Gersic]

>>> On 8/22/2013 at 09:51 AM, Gene Matthews <gmatthew at hitachi-cta.com> wrote: 
> We will have two different sp's talking to our Idp. They way the system is 
> being specified, users will always start at protected resources behind sp1 
> and at some point may click a link that will take them to a protected 
> resource at sp2.

I think you're over-thinking the problem. As long as both SP1 and SP2 are doing SSO via your IdP, this should be transparent to your users and your developers.


> Assuming sp1 successfully receives a security assertion from 
> our Idp, when the use clicks a link that will take them to a resource at sp2, 
> sp1 should attach that assertion somehow to the link to sp2, I'm thinking. 

No.

What'll happen is that the browser will be sent to SP2. SP2 won't have a valid session for them, so it redirects them to the IdP.  The IdP does its magic, and redirects them back SP2 with a valid session. Done.

At least I think that's what you're really going to end up doing. That'd be the basic default behaviour for the SP and IdP.