[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
Re: [higgins-dev] How specify the authentication method in the Relying Party Security Policy
|
Leonardo,
AFAIK you can't specify the authentication method as part of the RP
policy. The reasoning behind this is that the RP has a trust
relationship with the STS and trusts the method that the STS uses to be
"good enough". This also makes sense because the RP would have no way to
check if the STS actually used a specific method or just claims it did.
Of course the STS could support a set of (non-standard) claims that
assert that a certain method was used, which the RP could then require
in its policy.
hth,
--Chris
Leonardo Straniero schrieb:
Hi All,
I am trying to understand how to specify in the Relying Party Security
Policy the authentication method (e.g. username/pwd, X509 certificate,
…) a user has to use to authenticate to the IP/STS when requesting
security tokens.
I think it is necessary to insert another parameter into the RP’s
*web.xml* file.
I saw in a security policy example a field “*Issuer*” as follows:
* <param-name>Issuer</param-name>*
* <param-value>shib2.internet2.edu</param-value>*
I know the Higgins STS provides some endpoints:
* *
*…./services/MetadataX509Token* (X509
Authentication)
*…/services/MetadataUsernameToken *(UsernamePassword
Authentication)
and so on.
Is it possible to insert another parameter (for example a
MetadataReference parameter that identifies the STST endpoint to be
used) to specify the authentication method? Do you know if, adding a
parameter like this, CardSpace will properly manage it and select only
the cards that meet the required authentication method?
Any ideas?
Thanks in advance.
Best Regards.
* *
*============================*
*Dr. Leonardo Straniero*
CRS - Corporate Research
TXT e-Solutions SpA
c/o Tecnopolis N.O.
Strada Prov. per Casamassima Km 3
70010 Valenzano (BA) - Italy
------------------------------------------------------------------------
_______________________________________________
higgins-dev mailing list
higgins-dev@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/higgins-dev
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature