Question about transferring data between sites

Hi,

 

I’m currently working on a PoC for SSO using SAML 2.0 and
I understand how the assertion contains information about the user so that the
user can be authenticated by the Service Provider, but I’m trying to
figure out the best way to include a fairly large amount of information that
needs to be used in the application of the Service Provider.

 

For example, the destination application needs to receive
1000 characters of comment data that is used after the user is authenticated by
the SP. 

 

So, is it appropriate to include this information as part of
the assertion or is there a better way to transfer this data?  

 

Has anyone worked with including the information as part of
the initial call when the artifact is passed to the SP?

 

Thanks,

 

Chris
 Sharp