Re: [saml-dev] SAML 2.0 IsPassive option

["Dieter Maurer" <dieter@handshake.de>]

Chiranga Alwis wrote at 2016-5-10 10:43 +0530:
>I am a fresh user to SAML 2.0.
>
>When working on an Apache Tomcat SAML 2.0 based single-sign-on (SSO) valve,
>I came across the property named 'IsPassive' under SAML 2.0 Authentication
>Requests. The SAML 2.0 spec introduces this as follows:
>
>IsPassive [Optional] A Boolean value. If "true", the identity provider and
>the user agent itself MUST NOT visibly take control of the user interface
>from the requester and interact with the presenter in a noticeable fashion.
>If a value is not provided, the default is "false".

You can use "IsPassive" when you want to check whether the
user is already authenticated with the identity provider
and do not want under any circumstance that the identity provider
issues a login dialog.


One of the scenarios where this may be interesting is the
"identity provider iniated authentication". In this scenario,
the user first logs in with the identity provider and only then
switches to the service provider. The service provider can use
"IsPassive" to verify that the user has followed this procedure.

Another scenario may look as follows:
Assume there are a set potential identity providers for a given user.
The service provider may ask the set of those identity providers
with the "IsPassive" to check whether some of those already has
identified the user. Only if none has, it may present a list
of identity providers from which the user choses one to really log in.



--
Dieter