Re: Common Domain Problem
Bryan Field-Elliot <[email protected]> 25 Sep 2003 08:52:15 -0600
| Newsgroups | gmane.comp.sourceid.sso.devel |
|---|---|
| Message-ID | <[email protected]> |
--=-Den5FKtfMb8mrned2kkR Content-Type: text/plain Content-Transfer-Encoding: 7bit On Thu, 2003-09-25 at 07:52, Praveen Srivastava wrote: > hi, > > I m using SourceID.Java to make my two applications SSO enabled. > > In sourceid-sso.xml file we need to specify <common domain> and <common domain host> > > suppose, if my two applications are yahoo.com and hotmail.com both do not have a common domain something like X.Z.com and Y.Z.com ...so how we can have IDP introduction through cookies. > > At present I am using both applications on localhost and running on tomcat. Can u please give me an example how to give <Common domain> and <common domain host> > values. My IDP id TestIDP and SP is TestSP. > Hi Praveen, The idea is that one of the two sites, (or some neutral 3rd party), would maintain a "common domain" with subdomain aliases to the other "real" domains trying to share the Identity Provider Intro cookie. Example: hotmail.yahoo.com yahoo.com or, yahoo.hotmail.com hotmail.com or, yahoo.some-common-domain.com hotmail.some-common-domain.com These DNS records would point to the exact same places as the regular "hotmail.com" and "yahoo.com", but because they are aliased in this way, the two sites can share a common domain. Also note that the whole Identity Provider Intro cookie protocol, is an optional protocol in Liberty. There are many scenarios where it is not necessary. Example is, if all of your service providers have only one Identity Provider (or a short list of them), then they can automatically try each IDP on the short list, or ask the end user. The Identity Provider Intro protocol is most useful, when there are many IDP's in the circle of trust, and you don't want to bother the user asking them at login time, "which one is yours?" I hope that helps, > > ______________________________________________________________________ > Bryan Field-Elliot > CTO, Ping Identity Corporation > Federated Identity Management Solutions > Info: http://pingidentity.com > Email: [email protected] > --=-Den5FKtfMb8mrned2kkR Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/1.1.9"> </HEAD> <BODY> On Thu, 2003-09-25 at 07:52, Praveen Srivastava wrote: <BLOCKQUOTE TYPE=CITE> <PRE><FONT COLOR="#737373" SIZE="3"><I>hi, I m using SourceID.Java to make my two applications SSO enabled. In sourceid-sso.xml file we need to specify <common domain> and <common domain host> suppose, if my two applications are yahoo.com and hotmail.com both do not have a common domain something like X.Z.com and Y.Z.com ...so how we can have IDP introduction through cookies. At present I am using both applications on localhost and running on tomcat. Can u please give me an example how to give <Common domain> and <common domain host> values. My IDP id TestIDP and SP is TestSP. </I></FONT></PRE> </BLOCKQUOTE> <FONT SIZE="3"><BR> Hi Praveen,<BR> <BR> The idea is that one of the two sites, (or some neutral 3rd party), would maintain a "common domain" with subdomain<BR> aliases to the other "real" domains trying to share the Identity Provider Intro cookie.<BR> <BR> Example:<BR> <BR> hotmail.yahoo.com<BR> yahoo.com<BR> <BR> or,<BR> <BR> yahoo.hotmail.com<BR> hotmail.com<BR> <BR> or,<BR> <BR> yahoo.some-common-domain.com<BR> hotmail.some-common-domain.com<BR> <BR> These DNS records would point to the exact same places as the regular "hotmail.com" and "yahoo.com", but because they are aliased in this way, the two sites can share a common domain.<BR> <BR> Also note that the whole Identity Provider Intro cookie protocol, is an optional protocol in Liberty. There are many scenarios where it is not necessary. Example is, if all of your service providers have only one Identity Provider (or a short list of them), then they can automatically try each IDP on the short list, or ask the end user.<BR> <BR> The Identity Provider Intro protocol is most useful, when there are many IDP's in the circle of trust, and you don't want to bother the user asking them at login time, "which one is yours?"<BR> <BR> I hope that helps,<BR> <BR> <BR> </FONT><BR> <BLOCKQUOTE TYPE=CITE> <PRE><TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%"> <TR> <TD> <HR> <BR> Bryan Field-Elliot<BR> CTO, Ping Identity Corporation<BR> Federated Identity Management Solutions<BR> Info: <A HREF="http://pingidentity.com">http://pingidentity.com</A><BR> Email: <A HREF="mailto:[email protected]">[email protected]</A><BR> <BR> </TD> </TR> </TABLE> </PRE> </BLOCKQUOTE> </BODY> </HTML> --=-Den5FKtfMb8mrned2kkR--