Is there any way for an SP initiated application to be able to initiate from the IDP

[Paul Hethmon]

On Aug 27, 2014, at 11:42 AM, csross <cross at hccs.com<mailto:cross at hccs.com>> wrote:

Thanks for the response.  I haven't set up anything with the client yet.  He
is just saying that when we do, the user should not have to log into the IDP
since it has already logged in for some other application.  I have another
customer who is starting to indicate that they want to be able to access the
application without having to log into their IDP again.

That is totally up to their IdP and its settings.

If a user logs into an IDP for some other application, and then they access
our application by clicking on a link, will the proper packets be sent to my
SP so that it automatically logs them in?   I hope I am explaining it
correctly.

Go look up and read the OASIS SAML executive and technical overview documents.

Your application session is independent of any other sessions the user may have. The IdP is responsible for maintaining sessions with the browser so it knows when to grant access to your application by recognizing an existing session it has with the user or requiring the user to login again.

The only thing you can do to influence that behavior is to send the ForceAuthn attribute in the AuthnRequest. Almost all uses of that attribute are incorrect. Shib SP does not send it by default (pretty sure). That is the way you want it to be.

Paul

Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140827/a79d07a2/attachment.html