Session/Cookie Question

[IAM David Bantz]

Perhaps useful to some to recognize the (appropriate) design behind the
separation of functions between the SAML IdP and SP. The IdP provides
information about the user to the SP relying on that IdP. That
circumscribed role leaves details - especially details concerning different
"parts" or response locations - up to the service. That distribution or
segregation of responsibilities contrasts with a "central command" model in
which a single central hub assumes detailed control of "which users can do
what under what conditions. Those contrasting models reflect different
philosophies of how to provide trusted access to service; to put it a bit
contentiously, one facilitates collaboration and distributed control, the
other facilitates central authority and control.

In the current SAML IdP & SP context, that means a "terms of use" required
for a proper subset of functions behind the SP should be triggered and
recorded within the service.

Apologies if not helpful.

David St Pierre Bantz
U Alaska IAM

On Thu, Jan 2, 2025 at 9:30 AM Cantor, Scott via users <users at shibboleth.net>
wrote:

> > How does it know where the user was heading to?
>
> It doesn't, that's all up to the SP to handle. The things an IdP knows are
> the identity of the SP, the response location (from the metadata), and the
> state token, which is opaque.
>
> Of those, the identity of the SP is the only relevant bit that can be used
> in any sort of "what was the user trying to do?" sense.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250102/16c0c51a/attachment.htm>