SAML：服务提供商之间的通信？
我的任务是在 ASP.NET 中为 SAML v2.0 编写 SP（服务提供程序），我想知道以下内容；
如果用户在主 SP 上登录某项服务（用户可以将我的 SP 作为锚点/链接进行访问，除非之前添加了书签），然后请求访问我的 SP，我应该如何处理他们的登录？
他们将登录并获得主 SP 上 IdP 的授权，但该 SP 将如何告诉我的 SP 用户已登录？ 我是否必须向 IdP 发送新的授权请求来确定用户是否已登录，还是应该使用来自 SP 的查询字符串作为发布数据/重定向进行传递？
我会联系主要 SP 并询问如何继续，但我想先了解一下我的基础，看看是否有处理这种情况的标准方法。
I've been tasked with writing a SP (Service Provider) for SAML v2.0 in ASP.NET, and I wonder the following;
If a user logs in on the main SP for a service (where my SP becomes accessible for a user as an anchor/link, unless previously bookmarked), and then requests access to my SP, how should I handle their login?
They will have logged in and become authorized by the IdP on the main SP, but how will that SP tell my SP that the user is logged in?
Will I have to send a new authorization request to the IdP to determine whether the user is logged in or should it be passed on as post data/redirect with a query string from the SP?
I've read the technical overview as well as the basics, but they don't cover this part.
I will contact the main SP and ask how to proceed, but I wanted to cover my bases first and see if there's a standard way on how to deal with this situation.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
最简单的方法是让“主 SP”构建链接，以便为用户启动 IDP-Init SSO 来登录您的应用程序。因此，用户将显示从 IDP（客户）到您的 SP 的新断言。
您还可以让它们直接链接到您的站点，以便为给定的身份提供商/客户调用 SP-Init SSO。
无论您选择哪种方式，都需要您处理 SAML 2.0 的多个用例和选项。如果您想查看 Ping Identity 提供的 SaaS 合作伙伴计划，您可以在短时间内启动并运行它。 www.pingidentity.com
如果您想了解有关我们所见其他内容的更多信息，请告诉我
The easiest thing to do is to have the "main SP" construct the link so that IDP-Init SSO is initiated for users to log into your application. So the user would show up with a new Assertion from the IDP (customer) to your SP.
You could also have them directly link to your site to invoke SP-Init SSO for the given Identity Provider/Customer.
Either way you choose to do this will require you to handle multiple use cases and options for SAML 2.0. You can have this up and running in short order if you want to check out the SaaS Partner Program offered by Ping Identity. www.pingidentity.com
Let me know if you'd like more info on what we've seen other
为了执行 SP 发起的 SSO，您要么需要只需要向一个身份提供者发送身份验证请求，要么需要某种方法来确定特定用户的正确身份提供者（或者是用户）需要提供一些 IdP 识别信息（例如当您想使用 Google 或其他 ID 登录时 StackOverflow 会这样做），或者 URL 中可能嵌入了某些内容。 （对于我开发的应用程序，不同的客户端有自己的站点域，因此 IdP 会映射到这些站点域。）
因此，是的，如果您要采用 SP 发起的路线，您将需要向IdP 来确定用户是谁，并且您将需要使用 RelayState 将他们返回到最初请求的页面。如果它们已经在 IdP 上进行了身份验证，那么很可能会发生这种交换，而无需用户进行任何输入。
In order to do SP-initiated SSO, you either need for there to be only one identity provider that you might need to send authentication requests to, or you need some means of determining the proper identity provider for a particular user -- either the user needs to provide some IdP-identifying info (such as StackOverflow does when you want to log in using your Google or other ID) or there may be something embedded in the URL. (For the app I work on, different clients have their own site domains, so IdPs get mapped to those.)
So, yes, if you're going to go the SP-initiated route, you will need to make an authentication request to the IdP to determine who the user is, and you will want to use RelayState to get them back to the originally requested page. If they're already authenticated at the IdP, then most likely this exchange will happen without requiring any input from the user.