Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.014171418141914201421142214231424142514261427using HTTP 302 redirects to communicate register name identifier messages from the service provider to the identityprovider. The service provider effects a change in the identity providervia a URL redirection. For a discussion of the interactions and processing steps, refer to Section 3.3.1.1. Whenreviewing that profile, interchange all references to service provider and identity provider in the interaction diagramand processing steps 2-6. See Figure 8. Note that in step 4 the old SPProvidedNameIdentifier SHOULD be removedat the IdP.3.3.2.2. SOAP/HTTP-Based ProfileThe SOAP/HTTP-based profile relies on using SOAP over HTTP to communicate register name identifier messagesfrom the service provider to the identity provider. For a discussion of the interactions and processing steps, refer toSection 3.3.1.2. When reviewing that profile, interchange all references to service provider and identity provider inthe interaction diagram and processing steps. See Figure 9.Service ProviderIdentity Provider1. SOAP POST: ()3: SOAP 200 OK: ()2. ProcessRequest14281429143014311432143314341435143614371438143914401441144214431444144514461447Figure 9. SP-Initiated SOAP/HTTP-based profile for registering name identifiersThe following URI-based identifier MUST be used when referencing this specific profile:URI: http://projectliberty.org/profiles/rni-sp-soapIn step 1, the service provider sends a protocol messageto the identity provider’s SOAP endpoint specifying ,, and as defined in [LibertyProtSchema].The will only contain a value if the service provider haspreviously used the register name identifier profile.3.4. Identity Federation Termination Notification ProfilesThe Liberty identity federation termination notification profiles specify how service providers and identity providersare notified of federation termination (also known as defederation).Note:Other means of federation termination are possible, such as federation expiration and termination of businessagreements between service providers and identity providers. These means of federation termination areoutside the scope of this specification.Identity federation termination can be initiated at either the identity provider or the service provider. The PrincipalSHOULD have been authenticated by the provider at which identity federation termination is being initiated. Theavailable profiles are defined in Section 3.4.1 and Section 3.4.2, depending on whether the identity federationtermination notification process was initiated at the identity provider or service provider:1448• Federation Termination Notification Initiated at Identity ProviderLiberty Alliance Project40