Re: How do IDP recognize a previously authenticated user?

Antonio Bonavita wrote:

> Dear all,
> sorry for my English is not good.
>
> In order to implement SSO with SourceID.Java, I imagine this situation:
> a person wants to use some services supplied by SP1 and SP2.
> When the browser makes an http request to SP1, SP1 has to verify
> user authentication. In order to authenticate the user, it redirects the
> browser to IDP.
> Now user can fill its credentials, for example, to IDP and IDP redirects
> the user to SP1.
> User authentication is recognized by SP1.
> If user wants to make different http requests in a short period of time,
> how
> can SP1 "know" user http session state? I suppose SP1 sends cookies to
> the browser.

Yes, the mechanisms for tracking this incoming authentication are the 
similar to the ones used for tracking session state today - use a 
cookie, or do clever things with SSL session keys.

> Now I imagine the same person to contact SP2 for other services. How do
> SP2 know  that the user was already authenticated in the same circle of
> trust?
> I suppose SP2 redirect the browser to IDP for authentication. But now
> how can
> IDP recognise that the browser was previously used to authenticate the
> same user?
> Did IDP send a cookie to the browser in the response to previous request?

Circle of Trust is a slight misnomer, as the trust model and 
communications are really more hub-and-spoke structured, with the 
possibility of multiple hubs (multiple IDPs). If a site wants to 
authenticate a user, it either authenticates the user themselves, or 
requests authentication from an IDP. So you are correct in the first part.

The IDP just needs to recognize the user is authenticated when 
processing the request, so it can either rely on the same session 
tracking mechanisms as the SP, or alternatively use a browser-based 
security mechanism (HTTP Plain or Digest auth, some custom protocol for 
smart card auth, NTLM, etc.)

David Waite
Ping Identity Corporation