["Jahan Moreh" <jmoreh@sigaba.com>]

If the idea is to get a precise "Yes or No" answer, I agree with Conor. But, if the intent is to know if the IdP has previously authenticated the user, then I think the SP can use an <AuthnQuery>.

 

Thanks,

Jahan

 

---

From: Cahill, Conor P [mailto:conor.p.cahill@intel.com]
Sent: Monday, November 28, 2005 11:04 AM
To: prasanta behera; saml-dev@lists.oasis-open.org
Subject: RE: [saml-dev] SP --> IDP Auth

 

SP wants to know if the user is authenticated or not (status: Y or N) at the IDP?
How can I do that? 

There is *NO* way to do this in SAML (1.0 or 2.0).

 

The other answer's I've seen all deal with answering the question "Is the IdP willing to establish and/or share an authentication session with the SP?' or from the SP's point of view "Please provide whaterver authentication information you are allowed to provide for this user?"

 

If everything works and all permissions are granted, the SP finds out that the user is authenticated and that the IdP was willing to share that information with the SP. 

 

If it doesn't work (for many different reasons) the SP gets nothing.  So the SP can't tell if the user is authenticated or not at the IdP when it gets nothing.

 

There are many cases where the user will be authetnicated at an IdP where the SP cannot figure that out.

 

Conor