Embedding images from another SP

[Scott Koranda]

> On Fri, Apr 6, 2018 at 10:41 AM,  <shibboleth655 at lewenberg.com> wrote:
> >
> > Question: How can I get the images from site B to load on site A's web page
> > properly without making the user explicitly visit site B first?
> 
> Scott Koranda @ LIGO had a similar use case awhile back. Check the archives.
> 
> If I recall, the suggestion was to use artifact resolution. That may
> be a steep requirement. Not all IdPs support artifact resolution, and
> the current trend is to discontinue support for that protocol wherever
> possible.

Yes, LIGO has this use case.

We configure the Shibboleth SP on site B to prefer the artifact resolution
binding instead of POST.

When a user visits site A and establishes a session, both with the
Shibboleth SP on site A and with the IdP, the page with embedded
images is delivered to the browser. The browser "sees" IMG URLs on site
B. The background threads of the browser then send multiple GET requests
to site B for those URLs.

Since there is no session with the SP on site B those background threads
receive 302 redirects with SAML authentication requests. The threads
will follow the 302 and redirect to the IdP.

Since the browser already has a session with the IdP it will return a
new SAML assertion to the browser. Normally the response would use the
POST binding and the background browser threads would stop the flow
there because they will not evaluate the Javascript that would otherwise
POST the response to the SP on site B.

But if the IdP supports artifact resolution the SP on site B will
request it and so the browser will receive a 302 and follow it. Then the
SP on site B resolves the artifact, establishes the session, and is able
to retrieve the image.

This does require the IdP to support artifact resolution, but if it does
not and does not have an ACS in SAML metadata then the SP will just use
POST. The images do not load then. For that reason we put little links
at the bottom of those pages to allow those users to visit site B and
establish a session. Then they can reload the page on site A.

Since most LIGO users till use the LIGO IdP and it supports artifact
resolution, this works well.

The downside is that there are quite a few IdPs that publish an artifact
ACS URL but do not actually support it.

Scott K