Is there any way for an SP initiated application to be able to initiate from the IDP

[Paul Hethmon]

On Aug 27, 2014, at 11:22 AM, csross <cross at hccs.com<mailto:cross at hccs.com>> wrote:

I have a new customer who said they they do not want their users to log back
into the IDP when redirected from my SP, since they have already logged into
their IDP earlier for other reasons.  The client says that all the login
information is contained in the headers or tokens in the browser, so when
they access the SP, it should automatically be able to retrieve the login
information from the headers and access the protected application without
the user doing anything.

Your new customer needs to fix their IdP session time if it is a problem. Sending the redirect to the IdP when you don't have a session is the proper thing to do. If the user has a session, they don't have to login again. If they don't have a session, they login.

Just to check, are you forcing re-authentication by sending that in the AuthnRequest?

Paul


Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140827/c36cb317/attachment.html