[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [saml-dev] SAML 2.0 IsPassive option
Hi,theoretically such seemless authentication is still within the bounds of the isPassive definition. Such authentication methods could probably involve: * kerberos (as long as the 401 page is not being displayed to the end-user after failed login)
* remember me feature (a.k.a persistent cookie)Cert based authn is also similar, but with that the browser will ask for the password of the private key, not sure if that qualifies as passive authn.
cheers, Peter 2016. 05. 10. 12:17 keltezéssel, Chiranga Alwis írta:
Hi Dieter, first of all thanks for the answer. In addition, to what you have mentioned I came across this alternative usage of this property (from another source) which enables the Service Provider to ask the IdP to basically "authenticate this user only if you can do it without the having the user involved". This seems to map with the spec definition provided for the 'IsPassive' property under discussion. Is this a valid usage and what does it accurately mean in a real-world scenario? On Tue, May 10, 2016 at 1:18 PM, Dieter Maurer <dieter@handshake.de <mailto:dieter@handshake.de>> wrote: Chiranga Alwis wrote at 2016-5-10 10:43 +0530: >I am a fresh user to SAML 2.0. > >When working on an Apache Tomcat SAML 2.0 based single-sign-on (SSO) valve, >I came across the property named 'IsPassive' under SAML 2.0 Authentication >Requests. The SAML 2.0 spec introduces this as follows: > >IsPassive [Optional] A Boolean value. If "true", the identity provider and >the user agent itself MUST NOT visibly take control of the user interface >from the requester and interact with the presenter in a noticeable fashion. >If a value is not provided, the default is "false". You can use "IsPassive" when you want to check whether the user is already authenticated with the identity provider and do not want under any circumstance that the identity provider issues a login dialog. One of the scenarios where this may be interesting is the "identity provider iniated authentication". In this scenario, the user first logs in with the identity provider and only then switches to the service provider. The service provider can use "IsPassive" to verify that the user has followed this procedure. Another scenario may look as follows: Assume there are a set potential identity providers for a given user. The service provider may ask the set of those identity providers with the "IsPassive" to check whether some of those already has identified the user. Only if none has, it may present a list of identity providers from which the user choses one to really log in. -- Dieter
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]