This is the third post of a series about claims based identity management and the Windows Identity Foundation (WIF).
The first two were:
The previous post presented the claims model, namely concepts such as identity provider, identity consumer, claims and security tokens. In this one, we will describe some of the protocols available for the communication between providers and consumers, namely for requesting security tokens and exchanging them.
- The protocol begins by Alice’s browser making the initial HTTP request to the web app.
- Since this request does not contain any identity information, the response is a redirect to the IdP. Alice’s browser fulfills this redirect by sending a GET request to the IdP. The redirect target URL contains information contextualizing the request, namely the identity of the requesting web app.
- After this request, typically there is an interaction between the IdP and Alice’s browser with the purpose of authenticating the user. For example, the IdP may respond with an HTML form for username+password authentication, which is followed by a POST containing this information, sent by Alice’s browser. This interaction may also include a step where the IdP and Alice agree on the issued claims, which is useful when Alice wants some control over releasing parts of her identity.
- Finally, the IdP responds with a security token containing the issued claims. This response may be:
- A redirect to the web app, with the token encoded in the target URL, or
- An auto submitting HTML form, containing the token in an hidden field. The form’s target is the web app.
In the active protocols, the user-agent plays an active role in the protocols.
- The protocol starts by the user agent directly requesting a token from the IdP. This request must contain all the information required for the IdP to authenticate the requesting user and determine the claims to issue.
- Next, the IdP responds with the issued token.
- Finally, the user agent sends the request to the Identity Consumer (typically a service), with the token attached.
The WS-Trust is an example of an active protocols based using the SOAP and WS-* specifications.
In the next post we will show some examples of security tokens, namely the SAML assertion format.