How do IDP recognize a previously authenticated user?
Antonio Bonavita <[email protected]> Wed, 05 Jan 2005 14:53:38 +0100
| Newsgroups | gmane.comp.sourceid.sso.user |
|---|---|
| Message-ID | <[email protected]> |
Dear all, sorry for my English is not good. In order to implement SSO with SourceID.Java, I imagine this situation: a person wants to use some services supplied by SP1 and SP2. When the browser makes an http request to SP1, SP1 has to verify user authentication. In order to authenticate the user, it redirects the browser to IDP. Now user can fill its credentials, for example, to IDP and IDP redirects the user to SP1. User authentication is recognized by SP1. If user wants to make different http requests in a short period of time, how can SP1 "know" user http session state? I suppose SP1 sends cookies to the browser. Now I imagine the same person to contact SP2 for other services. How do SP2 know that the user was already authenticated in the same circle of trust? I suppose SP2 redirect the browser to IDP for authentication. But now how can IDP recognise that the browser was previously used to authenticate the same user? Did IDP send a cookie to the browser in the response to previous request? I thank you in advance and sorry if my questions are already done. Antonio