Where to specify which ACS to use for logging in?

[Cantor, Scott]

> > The artifact binding flows help with a specific LIGO use case.
> > In short, the background threads used by a browser to fetch
> > image URLs embedded in the main HTML page but served from
> > other SPs will often succeed in the SSO flow when the artifact
> > binding is used because the flow only involves GET requests
> > and no POSTs.
> 
> I've never understood this use case. I don't see what the artifact
> protocol has to do with images.

Embedded content means that the browser can't respond to a form challenge or do a form submission. If the user is already logged in at an IdP, then subsequent requests via artifact from other SPs will be silent, automatic, and since they're just rediec-based, they'll succeed. If you use POST, they won't.

The problem is that SAML artifacts weren't designed properly and so making them clusterable is hard. OIDC's main advantage in this regard is that since the artifact is opaque, it can be implemented in a way that is fully stateless. SAML artifacts can also, but it would require a new artifact type and we haven't bothered given the general attitude about it.

-- Scott