> This is basically account linking.
> Ok now I cannot find how SAML 2.0 achieve this in any of the
> spec at the OASIS web page:
Core, section 8 on Identifier formats, persistent format. That's about it.
Plus the protocol for NameID rollover and cleanup, of course.
If you're looking for anything else, you're moving out of scope.
> 2) Also there is a mention about SAML 2.0 providing a
> protocol which doesn't requires cookies to be exchanged
> between SP and IDP to achieve session management,
SAML SSO doesn't rely on domain cookies. That's it. It doesn't mean they
each individually don't use cookies.
-- Scott
