Burden of Authorization

[Peter Schober]

* federator <wpadmin at identiainc.com> [2014-12-18 21:41]:
> A user needs only one transaction to complete authentication.  Once
> user is authenticated via an IdP, no interaction is needed between
> IdP and your browser (except SLO).  From that point, every user
> transaction occurs between the user and the corresponding SP(s)
> directly.

Not so. For every SP you access the SP will bounce you to the IDP with
an authN request and will get a SAML assertion as a response (or an
error in a SAML protocol message). The IDP is involved in /all/ of
those transactions. At an SP the SAML assertion is then "traded" for
an HTTP Cookie to maintain a session, but that doesn't mean that after
authenticating at the IDP everything "occurs between the user and the
corresponding SP(s) directly". If that were the case you couldn't send
different sets of attributes to different SPs, in assertions signed by
the IDP.
-peter