Pass dynamic properties from SP to IdP?

[Cantor, Scott]

On 9/3/13 2:21 PM, "Brian Reindel" <brian at reindel.com> wrote:

>I have some dynamic information I would like to pass from the SP to
>the IdP for use during external authentication. I can't find anything
>that would allow me to do this. Is this possible, and if it is, can
>those properties be accessed in the external authentication servlet I
>create on the IdP?

That's not permitted in SAML except by means of an extension to the
AuthnRequest. I don't know for certain that the servlet in that particular
instance has access to the request message either but if it has access to
the LoginContext managed by the IdP during the process, it would.

In any case, this is a very complex thing to do and is best avoided, but
it's theoretically possible.

Since there's very little use of the complexity of the protocol as it is,
I would be interested to know what the use case is.

-- Scott