Hi everyone,<br><br>I'm trying to think through a few methods to solve a
problem accomplishing SSO through disparate authentication sources.
Say for example:<br><br><a href="http://idp.one.com/" target="_blank">idp.one.com</a><br><a href="http://sp.one.com/" target="_blank">sp.one.com</a><br>
<a href="http://idp.two.com/" target="_blank">idp.two.com</a><br><a href="http://sp.two.com/" target="_blank">sp.two.com</a><br><a href="http://idp.three.com/" target="_blank">idp.three.com</a><br><a href="http://sp.three.com/" target="_blank">sp.three.com</a><br>
<br>Each
IdP has an entirely separate user/pass namespace. And, I want each IdP
to "trust" each other, in the sense that any user logged in at any of
the IdPs will <i>transparently</i> have access to each SP without
logging in again. No discovering IdP's or selecting where to log in,
and only a single authentication allows access to all domains.<br>
<br>Something similar to the Common Domain Cookie might solve this problem, but the spec for that cookie seems too simple. If <a href="http://idp.one.com/" target="_blank">idp.one.com</a>
were the common domain in this example, could a series of auth tokens
be concatenated together which would validate authentication at any of
the IdPs? (Say, similar to OAuth tokens)<br>
<br>Then the authentication flow would be something like:<br><br>* <a href="http://sp.three.com/" target="_blank">sp.three.com</a> is unauthenticated, redirect to <a href="http://idp.three.com/" target="_blank">idp.three.com</a>.<br>
* <a href="http://idp.three.com/" target="_blank">idp.three.com</a> is unauthenticated, redirect to <a href="http://idp.one.com/" target="_blank">idp.one.com</a><br>
* <a href="http://idp.one.com/" target="_blank">idp.one.com</a> is unauthenticated, redirect back to <a href="http://idp.three.com/" target="_blank">idp.three.com</a> in a state of "no authentications have happened, proceed to log in"<br>
* Log in at <a href="http://idp.three.com/" target="_blank">idp.three.com</a>, create an authentication token<br>
* Redirect to <a href="http://idp.one.com/" target="_blank">idp.one.com</a> and pass a token as a parameter, along with SAML attributes<br>* <a href="http://idp.one.com/" target="_blank">idp.one.com</a> authenticates from the token + attributes, sets a cookie for <a href="http://one.com/" target="_blank">one.com</a> with the concatenated the <a href="http://three.com/" target="_blank">three.com</a> token<br>
<br>Then another unauthenticated hit to <a href="http://sp.two.com/" target="_blank">sp.two.com</a> would:<br><br>* Redirect to <a href="http://idp.two.com/" target="_blank">idp.two.com</a>. It's unauthenticated, redirect to <a href="http://idp.one.com/" target="_blank">idp.one.com</a><br>
* <a href="http://idp.one.com/" target="_blank">idp.one.com</a> has the CDC trusted token for <a href="http://three.com/" target="_blank">three.com</a>, along with SAML attributes stored in a session<br>* Redirect to <a href="http://idp.two.com/" target="_blank">idp.two.com</a> with a parameter list of the token + SAML attributes<br>
* <a href="http://idp.two.com/" target="_blank">idp.two.com</a> sets a cookie for <a href="http://two.com/" target="_blank">two.com</a>, redirects to <a href="http://sp.two.com/" target="_blank">sp.two.com</a> with successful authentication<br>
<br>Of
course, this is absolute redirect hell. And session management is
going to be horrible. Are there any protocols that attempt to solve
this problem?<br>
<br>Thanks!<br><font color="#888888"><br>--Cal</font>