[EXT] Embedding images from another SP

[Yeargan, Yancey]

Interesting. Can site B be used normally, or is it limited to this use case? If someone goes directly to site B without a pre-established SAML session, does site B initiate a normal authentication request via the POST binding?

-Yancey

> On Apr 6, 2018, at 12:38 PM, Scott Koranda <skoranda at gmail.com> wrote:
> 
>> On Fri, Apr 6, 2018 at 10:41 AM,  <shibboleth655 at lewenberg.com> wrote:
>>> 
>>> Question: How can I get the images from site B to load on site A's web page
>>> properly without making the user explicitly visit site B first?
>> 
>> Scott Koranda @ LIGO had a similar use case awhile back. Check the archives.
>> 
>> If I recall, the suggestion was to use artifact resolution. That may
>> be a steep requirement. Not all IdPs support artifact resolution, and
>> the current trend is to discontinue support for that protocol wherever
>> possible.
> 
> Yes, LIGO has this use case.
> 
> We configure the Shibboleth SP on site B to prefer the artifact resolution
> binding instead of POST.
> 
> When a user visits site A and establishes a session, both with the
> Shibboleth SP on site A and with the IdP, the page with embedded
> images is delivered to the browser. The browser "sees" IMG URLs on site
> B. The background threads of the browser then send multiple GET requests
> to site B for those URLs.
> 
> Since there is no session with the SP on site B those background threads
> receive 302 redirects with SAML authentication requests. The threads
> will follow the 302 and redirect to the IdP.
> 
> Since the browser already has a session with the IdP it will return a
> new SAML assertion to the browser. Normally the response would use the
> POST binding and the background browser threads would stop the flow
> there because they will not evaluate the Javascript that would otherwise
> POST the response to the SP on site B.
> 
> But if the IdP supports artifact resolution the SP on site B will
> request it and so the browser will receive a 302 and follow it. Then the
> SP on site B resolves the artifact, establishes the session, and is able
> to retrieve the image.
> 
> This does require the IdP to support artifact resolution, but if it does
> not and does not have an ACS in SAML metadata then the SP will just use
> POST. The images do not load then. For that reason we put little links
> at the bottom of those pages to allow those users to visit site B and
> establish a session. Then they can reload the page on site A.
> 
> Since most LIGO users till use the LIGO IdP and it supports artifact
> resolution, this works well.
> 
> The downside is that there are quite a few IdPs that publish an artifact
> ACS URL but do not actually support it.
> 
> Scott K
>