Cross-Context External Authn w/ IdP Initiated SSO

[Tom Scavo]

On Fri, Jul 25, 2014 at 12:09 PM, snekse <snekse at gmail.com> wrote:
>
> The statement about being lazy about supporting SAML seems odd to me since
> it's part of the SAML spec.

IdP-initiated SSO is not part of the spec, at least not at the
protocol level. There is no standard way to induce an IdP to initiate
SAML Web Browser SSO.

> My
> understanding is that if the user bookmarked the 3rd party site and their
> auth expired, then the SP would present identity providers to the user and
> our IdP just needs to be able to respond to standard browser SSO auth
> requests. Is that way off?

No, it sounds right to me, but that's not IdP-initiated SSO.

> If the user in on my
> website and I want to send them to another website (with them already
> authenticated into that site), how would I generate a SAML request from the
> browser?

If I understand you correctly, you don't. Instead you present a link
to the "other website" and let the chips fall where they may.

> When I first looked at this problem, I figured I'd use standard
> browser SSO: Send them to the resource on the SP via a get request, put the
> IdP entity ID in the URL as a param, have the SP start the authentication
> process and go from there.

There is no standard protocol to do that, so it depends on the IdP in
question. Shibboleth and simpleSAMLphp do this differently, for
example.

> Am I reading this first paragraph wrong?
> http://bit.ly/SAML_2_IdP_Initiated_POST_Binding (Section 5.1.4)

That's not a spec. Since there is no standard way to invoke such a
process, if you want to induce an IdP to initiate that process, you
need to know the SAML implementation in use.

> If I'm reading this somewhat correctly, then my website should have a link
> to my IdP with parameters to ID the SP resource (via RelayState?).

You're assuming you know in advance what SAML implementation the IdP is using.

> What I
> don't know from the Shibboleth side is what URL (or form POST) do I use for
> the link in step 3?
>
> The Shibboleth docs seem to indicate that I should be using
> '/idp/profile/SAML2/Unsolicited/SSO'

You've hit the nail on the head. That only works with Shibboleth, and
since that path prefix is configurable (and not published in metadata)
you really have no way to know in advance if it's going to work.

Tom