SAML 2.0: LECP Solution Proposal Work Plan Item W-5a Frederick - - PowerPoint PPT Presentation

SAML 2.0: LECP Solution Proposal

Work Plan Item W-5a

Frederick Hirsch 23 October 2003

Intent: Add an additional profile

• Web Browser Artifact Profile
• Web Browser POST Profile
• LECP Profile

Use Case

• Mobile phone user accesses web site for service
• Site requests authentication in HTTP response
• Client obtains authentication assertion from

identity server it determines, e.g. mobile operator

• Client passes assertion to service provider
• Service provider returns response

(Note: LECP may be client or proxy)

Considerations

• Client (or proxy) determines appropriate identity provider
• Accommodate high-latency or unreliable networks

– Minimize redirects

• Accommodate constrained devices

– Limited or no cookie support – URL length limitations – Scripting limitations (e.g. ECMAScript not supported)

• Minimal impact on service providers

Impact

• New profile document: LECP Profile
• Profile specific schema definitions

– AuthnRequestEnvelope, AuthnResponseEnvelope – IDPList

• Core schema definitions

– AuthnRequest, AuthnResponse

LECP Profile

• HTTP request including liberty enabled client

HTTP header

• HTTP response with AuthnRequest
• Client web services request containing

AuthnRequest

• Web services response with AuthnResponse
• AuthnResponse in HTTP request to server
• Server HTTP response with service

LECP Flow

IDP LEC SP HTTP GET 1

AuthnRequest AuthnRequest SOAP AuthnResponse SOAP AuthnResponse

200, 0K …

2 3 4 5 6

AuthnRequestEnvelope

• AuthnRequest – the Liberty 1.1 authentication

request

• ProviderId – Identifier for SP
• ProviderName – Human readable name for SP
• IDPList – list of IDPs acceptable to SP, optional

information for LEC

• IsPassive – if “true”, do not interact with principal

AuthnResponseEnvelope

• AuthnResponseEnvelope
• AuthnResponse
• AssertionConsumerServiceURL – URL IDP

anticipates based on MetaData

LECP: Profile

Schema elements

• AuthnRequest
• AuthnResponse
• AuthnRequestEnvelope
• IDPList
• AuthnResponseEnvelope

Liberty 1.1/1.2 Changes

• Lib namespace changed
• AuthnRequest

–

Added optional Extension element

–

Added support for Affiliations, optional AffiliationID element

–

Added NameIDPolicy, ProxyAuthn, IntroductionArtifact, consent attribute

–

Removed Federate element, ID attribute

–

Changed name of AuthnContext to RequestAuthnContext, moved related elements to subelements

• AuthnResponse

–

Added optional Extension element

–

Added optional consent attribute

–

Removed id attribute

Liberty 1.1/1.2 Changes

• AuthnRequestEnvelope

–

Optional Extension element

• IDPList

–

Loc now required, previously optional

• AuthnResponseEnvelope – no change
• Protocols & Schemas 1.2

–

https://www.projectliberty.org/specs/draft-lib-arch-protocols-schema-v1.2-17.pdf

• Protocols & Schemas 1.1

–

https://www.projectliberty.org/specs/archive/v1_1/liberty-architecture-bindings-profiles-v1.1.pdf

Proposed Next Steps

• LECP Profile

– Include LECP specific schema definitions

• Core schema changes

– AuthnRequest, AuthnResponse