The SAML web site is not longer accepting new posts. Information on this page is preserved for legacy purposes only. For current information on SAML, please see the OASIS Security Services Technical Committee Wiki.

Identity propagation with SAML


In my scenario I have the following entities:

- SAML secured Portal (Domain A)

- User

- SAML secured API( Domain B, so different domain than the portal)

- an IdP

The user will login first to the portal, when not authenticated, the portal will redirect him to the identity provider to login. Once logged in to the IdP and hence to the Portal, the Portal will possess a SAML token identifying the user.

Now this portal will need to automatically call the API (present on another domain), and pass to it a SAML token identifying the user.

Problem is that the portal only posses the token that has been provided to him, and hence my question:

How can I propagate the identity of the user through the invocation chain? What are the constraints that the issued token should respect to make sure it can be "shared" by different entities?

 Many thanks in advance



Ihab Focus Areas: BPEL | DITA | ebXML | IDtrust | OpenDocument | SAML | UBL | UDDI
OASIS sites: OASIS | Cover Pages | | AMQP | CGM Open | eGov | Emergency | IDtrust | LegalXML | Open CSA | OSLC | WS-I