Re: [saml-dev] Use of Provider ID in Redirect-Artifact Profile

[Tom Scavo <trscavo@gmail.com>]

On 10/20/05, Kunal Gandhi <kunal@amsoft.net> wrote:
>
> I have implemented Redirect-Artifact Profile for authentication.

Since you mention "common domain" below, I assume you're talking about SAML 2.0.

> 1. Upon verification of credentials, IDP does a redirect to the SP with a
> SAML Artifact
>
> 2. During the redirect, the IDP drops a common domain cookie on user's
> machine. The name of this cookie is the same as the 'ProviderID' in the SAML
> Artifact and its value is an identifier which can be resolved (by the SP) to
> get IDP's Artifact Resolution Service?

I think you're mixing apples and oranges here.  Let's ignore the
common domain cookie for a moment.  Shouldn't the SP extract the
SourceID and EndPointIndex from the artifact and do a metadata lookup
to determine the artifact resolution endpoint location at the IdP?

> 2b. Can I just put the value of the cookie as the URI of the IDP's Artifact
> Resolution Service? This would save a step to resolve IDP's identifier. Is
> there any restriction as to what value the cookie can have?

The common domain cookie is for IdP discovery, not artifact
resolution, so I'm not sure what you're trying to do here.  I must be
missing something.

Tom