What for is the backchannel

[Peter Schober]

Adding a subjective view to Scott's reference to the documentation,
since I had already written it:

* Ulf Seltmann <ulf.seltmann at hmt-leipzig.de> [2021-03-02 13:37]:
> My question is: do i need backchannel-support? What is it used for,
> what clients rely on it, is it an upcoming trend to use the
> soap-endpoint so that i generally want to support it...

Be sure to also ask that on the DFN-AAI users list, as the answers
you'll get there will differ significantly from those on this list. ;)

A new trend certainly not. FWIW, I've removed any mention of the
backchannel from our own local documentation years ago, and (very)
large parts of the global academic community are completely devoid of
any backchannel use.

It can be used to (try to) properly support SLO but since hardly any
SP properly supports SLO that's a moot point.
It could be used for transfer of (very large or extremely large
amounts of) attributes (AttributeQuery), outside of the browser, or to
allow the SP to query the IDP/AA about subjects already known from
earlier SSO transactions without the user being present/involded later
(a bit like federated LDAP, which is as much a problem as it is a
feature, I suppose).
E.g. In Germany and Switzerland some make use of this to implement
federated deprovisioning based on repeated attribute queries (and once
some key data is missing in the response you start the local
deprovisioning process). But that's not something that scales well
across institutional borders and the level of support for such queries
today is probably approaching that of proper SLO (i.e., zero).

There are more esoteric features for more esoteric use-cases
(e.g. Artifacts have quite a few interesting properties) but you won't
encouter any of these in your career as an IDP admin in 2021.
The deprovisioning focus in parts of Germany is probably the only
context you'll ever encouter it.

-peter