[EXT] Embedding images from another SP

[Scott Koranda]

> * Yeargan, Yancey <Yancey.Yeargan at untsystem.edu> [2018-04-07 21:40]:
> > Interesting. Can site B be used normally, or is it limited to this
> > use case? If someone goes directly to site B without a
> > pre-established SAML session, does site B initiate a normal
> > authentication request via the POST binding?
> 
> Why should it use POST binding just because you access resources by
> going to site B directly? If Artifacts are configured and working they
> will also continue working that way.

Yes. The SP for site B is configured to prefer the artifact binding and
will try to use it if it finds the IdP has an artifact binding in the
SAML metadata. This is true no matter how the SP/service is accessed.
It is indeed used "normally" for some use cases, in addition to serving
image files for inclusion in pages served by other hosts.

I neglected to mention before that IdP discovery also plays a role here.
In order for the browser background threads to cause the SAML
WebSSO flow to run to completion it is necessary that, if there
is more than one IdP federated with the SP for site B, there be a way
for IdP discovery to "work" without user intervention. 

The Shib SP configuration option "idpHistory" on the Session element in
conjunction with the Cookie Session Initiator makes it possible, but
LIGO also leverages the Shibboleth Embedded Discovery Service (EDS)
with the "remember my choice" functionality.

Thanks,

Scott K