Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.098498598698798898999099199299399499599699799899910001001100210031004which is REQUIRED (mandatory to implement) for any implementation of the Liberty browser artifact profile. Thisartifact type is defined as follows:TypeCode := 0x0003RemainingArtifact := IdentityProviderSuccinctID AssertionHandleIdentityProviderSuccinctID:= 20-byte_sequenceAssertionHandle := 20-byte_sequenceIdentityProviderSuccinctID is a 20-byte sequence used by the service provider to determine identity provideridentity and location. It is assumed that the service provider will maintain a table of IdentityProviderSuccinctIDvalues as well as the URL (or address) for the corresponding SAML responder at the identity provider. Thisinformation is communicated between the identity provider and service provider out of band. On receiving the SAMLartifact, the service provider determines whether the IdentityProviderSuccinctID belongs to a known identityprovider and, if so, obtains the location before sending a SAML request.Any two identity providers with a common service provider MUST use distinct IdentityProviderSuccinctIDvalues. Construction of AssertionHandle values is governed by the principles that the values SHOULD have nopredictable relationship to the contents of the referenced assertion at the identity provider, and that constructing orguessing the value of a valid, outstanding assertion handle MUST be infeasible.The following rules MUST be followed for the creation of SAML artifacts at identity providers:10051006100710081009101010111012• Each identity provider selects a single identification URL, corresponding to the provider metadata elementProviderID specified in [LibertyMetadata].• The identity provider constructs the IdentityProviderSuccinctID component of the artifact by taking theSHA-1 hash of the identification URL as a 20-byte binary value. Note that the IdentityProviderSuccinctIDvalue, used to construct the artifact, is not encoded in hexadecimal. The AssertionHandle value is constructedfrom a cryptographically strong random or pseudo-random number sequence (see [RFC1750]) generated by theidentity provider. The sequence consists of a value of at least eight bytes. The value should be padded to a totallength of 20 bytes.1013101410151016101710181019102010213.2.3. Liberty Browser POST ProfileThe Liberty browser POST profile allows authentication information to be supplied to an identity provider without theuse of an artifact. Figure 3 diagrams the interactions between parties in the Liberty POST profile. This profile is anadaptation of the "Browser/post profile" for SAML as documented in [SAMLBind11].The following URI-based identifier MUST be used when referencing this specific profile (for example, element of the message):URI: http://projectliberty.org/profiles/brws-postThe Liberty POST profile consists of a series of two interactions, the first between a user agent and an identity provider,and the second directly between the user agent and the service provider.Liberty Alliance Project27