Title: AuthnRequest and isPassive=true
isPassive=true was intended to be used by a Relying Party when they would like to know who you are, but not enough to ask the IdP to actually interact with the user. If the IdP doesn’t have an existing session with the user or has not already gotten permission to send an assertion to the RP, the IdP is expected to respond with an “I don’t know” to the RP. So you can see it as an RP indicator to the IdP that the RP doesn’t want the IdP to prompt the user for credentials/permission.
This allows an RP to do something like saying “Welcome Conor” and giving me a user customized home page without the need for me to authenticate to get it. Sort of like what happens when you go to Amazon, but without the need for a cookie.
Conor
From: Paul Hethmon [mailto:]
Sent: Monday, September 13, 2010 5:30 PM
To: SAML Dev
Subject: [saml-dev] AuthnRequest and isPassive=true
Is there any commentary expanding on the spec in what isPassive=”true” means? Or is meant to mean?
The description of “not visibly taking control” seems a bit ambiguous. Does that mean the login screen should mimic the service provider site? Does that mean return an error otherwise?
thanks,
Paul
