Re: First contact

[Anders Rundgren <anders.rundgren@telia.com>]

First contactHi Tim,
I appreciate discussions in this area as I feel that there are some less
clear things in SAML!  Anyway, some comments in-line.

>Push model 
>Browser                   Content site         Authentication site 
>1 <----------- redirect---------- 
>2 -------------redirect-----------------------------------> 
>3 <-------------------------authenticate------------------> 
>4                                  <-------assertion------- 
>5                                  --------reference------> 
>6 <-----------------------------------redirect(reference)-- 
>7 --------redirect(reference)---> 

>The Push model leaves questions like ... 
>How does the Authentication site know where to send the assertion? 

     By having the redirect in #1-2 contain this information

>How does the Authentication site know what attributes to include in the assertion? 

   By having the redirect specify what it wants, and let the user or the
   user's authority do some choices.  Shibboleth use-case

>Furthermore, the authentication thread is occupied waiting for the reference to return from the Content site. 

   This is indeed a problem.  The easiest solution is to not use
   references but entire assertions:

      http://www.x-obi.com/OBI400/andersr-browser-artifact.ppt

>In both cases, the Content site has no opportunity to indicate its authentication
>requirements (one or two factor, for instance).  

   It has that in the redirect.

Regards
Anders Rundgren
X-OBI