Can extra attribute be passed from SP?

"Rukkandan, Lakshmi" <[email protected]> Wed, 19 May 2004 16:52:49 +1000
Newsgroups gmane.comp.sourceid.sso.devel
Message-ID <4BEBE6210F29D311BCA90008C75B88C6086E2FDA@ntmsg0082.corpmail.telstra.com.au>
Hi All,

I'm trying to demonstrate federating  multiple SP's with single IDP =
using SourceID.java. Its an internal federation (SP's and IDP's are from =
same company). I'm trying to use same Federation store for both SP and =
IDP, user stores are seperate (i.e. userid and credentials) for each of =
the SP.=20

Now, I would like to send "Service ID" as an extra parameter, when =
federation is requested from specific Service Provider as part of the =
<AuthnRequest>. Is it possible to do so? Or is there any other means, to =
pass this information from SP to IDP?=20

I need to do this, as I'm maintaning same Federation store (LDAP Server) =
to write both SP and IDP federation information. When federation occurs, =
I randomly generate a unique identifier called "Principal-Id" under =
which I store each of the federation information.

For eg. lets consider the following values, as a result of "jdoe" from =
"serviceA" of sample-sp federating with "john" of "sample-idp". Note =
that two different  Principal-Id has been created (though both are same =
user). When new federation occurs, to make an entry into the Fed. Store, =


  1) Search first to see if such user has already done any federation =
(by passing userId,providerId,serviceId)
     1.a)  Yes =3D> then check if user from same same serviceId
               1. i)  No =3D> then write the federation information =
under same Principal-Id.=20
               1. ii) Yes =3D> don't do anything, say federation already =
exists!
     1.b)  No =3D> create new principal-Id and write federation =
information under that.

The above process can't be done just based on "userId + providerId" =
alone, as there might be same userid from a different service federated =
(as "jdoe" be existing in "serviceB"). So, I'm passing (userID + =
providerId +serviceId) as search criteria. This is where I need to send =
"serviceId" along with the "userId" and "providerId". The problem is I =
can obtain userId and providerId as they are required attributes of the =
<AuthnRequest>, but not sure how to pass "serviceId".=20

(SP's Fed.Information)
---------------------------------
Pricipal-Id=3D100		 	=09
userId=3Djdoe=09
ProviderId=3Dsample-idp
LocalName=3Dxyz=09
RemoteName=3Dxyz=09
ServiceId=3DserviceA

(IDPs Fed.Information)
--------------------------------
Pricipal-Id=3D200		 	=09
userId=3Djohn
ProviderId=3Dsample-sp=09
LocalName=3Dxyz
RemoteName=3Dxyz
ServiceId=3DserviceA


Please let me know, if this is possible? I would much appreciate an =
early reply, and thanks in advance for your time.

Regards,
Lax