The problem with IDP initiated SSO

[Cantor, Scott]

On 12/24/14, 12:50 AM, "federator" <wpadmin at identiainc.com> wrote:



>The title is misleading.  If you read the Note part it says:
>"For deep linking to work, IdP-initiated SSO via the Authentication 
>Service must have been performed previously for that user. Salesforce 
>redirects the user only when it finds the ssostartpage cookie, which is 
>set only during IdP-initiated SSO via the Authentication
> Service."

The title is accurate. They are simply issuing a proprietary message back 
to the IdP, so that is not IdP-initiated. They drop a cookie when they 
*do* IdP-iniated SSO to detect that their non-standard solution is 
available.

None of that is required when you simply implement the standard in the 
first place, which Salesforce in fact does. They support SP-initiated SSO, 
but they probably didn't at the time Ping implemented that nonsense.

>Agree that this has to be a proprietary solution of some kind, until some 
>company like Ping with deep pocket push it through OASIS.

Ping doesn't have deep pockets, but if they tried to propose that to the 
SSTC, it would be dismissed as completely unnecessary because it's nothing 
but a duplication of the existing feature set.

>The reason I stayed long on this thread and loved seeing so many 
>responses is because we do have a big client who actually wants 
>IdP-initiated SSO/Login to be implemented.  So regardless of the 
>pros/cons, how well can Shibboleth handle IdP-initiated SSO?  

As well as any other IdP, in a proprietary way that will never be anything 
but proprietary because that's all it can ever be.

> Has anyone used this feature in a Shib-based IdP implementation?

Many people.

-- Scott