I suppose that would solve the problem, if all SPs could authenticate at any given source. Then an unauthenticated request to a peer SP would flow through the already authenticated IdP. But the user would still have to perform some selection process to choose the IdP. <br>
<br>In my case, I'd like the first hit to all subsequent SPs to authenticate without any extra clicks or decisions involved. <br><br>Plus, as this peer (discovered) relationship grows it becomes a complex selection process. I'm thinking potentially this authentication method could grow to hundreds of SP/IdP pairs. In that case, a tiered IdP paradigm would fit better. One master authenticator to keep track of them all, but each session could transparently propagate to all systems.<br>
<br>I'm sort of in the brainstorming phase now... but now that I think about this more, I believe I might have just described OpenID.<br><br>Any thoughts on other protocols that accomplish this?<br><br>Thanks,<br><br>
--Cal<br><br><div class="gmail_quote">On Tue, Nov 22, 2011 at 10:50 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
* Cal Heldenbrand <<a href="mailto:cal@fbsdata.com">cal@fbsdata.com</a>> [2011-11-22 17:35]:<br>
<div class="im">> Each IdP has an entirely separate user/pass namespace. And, I want each<br>
> IdP to "trust" each other, in the sense that any user logged in at any of<br>
</div>> the IdPs will *transparently* have access to each SP without logging in<br>
<div class="im">> again. No discovering IdP's or selecting where to log in, and only a<br>
> single authentication allows access to all domains.<br>
<br>
</div>I probably don't understand the requirements but if all three SPs<br>
federate with all three IdPs the only problem left to solve is IdP<br>
discovery, no?<br>
-peter<br>
<font color="#888888">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></blockquote></div><br>