<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:CourierNewPSMT;
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:ProximaNova-Regular;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Group - this looks straightforward and helpful, so unless anyone has comments, will fold into the spec.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Openid-specs-fastfed <openid-specs-fastfed-bounces@lists.openid.net> on behalf of Openid-specs-fastfed <openid-specs-fastfed@lists.openid.net><br>
<b>Reply-To: </b>Karl McGuinness <kmcguinness@okta.com><br>
<b>Date: </b>Tuesday, February 25, 2020 at 8:48 AM<br>
<b>To: </b>Openid-specs-fastfed <openid-specs-fastfed@lists.openid.net><br>
<b>Subject: </b>[Openid-specs-fastfed] FastFed Profile for SAML 2.0 LoginHint Proposal<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hello FastFed Working Group,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The SAML 2.0 Web SSO profile unfortunately doesn’t define a prescriptive pattern for flowing the user identifier from the Service Provider to the Identity Provider during SP-init SSO resulting in the poor UX for the end-user having to type
their identifier twice. This is very common interaction with SaaS and would love to see us take advantage of profiling SAML 2.0 with FastFed to define this pattern. OpenID Connect defines this pattern with the <span style="font-size:10.0pt;font-family:"CourierNewPSMT",serif;color:black;background:white">login_hint </span>parameter.
Some SAML implementations have carried this parameter over from OIDC to SAML.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I am proposing we add the following to the FastFed Profile for SAML 2.0. I used SAML Pascal Case naming convention for the parameter and not the OIDC snake_case convention.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black">LoginHint (OPTIONAL)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Hint to the Identity Provider about the login identifier the End-User might use to log in (if necessary). This hint can
be used by a SP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered Identity Provider. It is RECOMMENDED that the hint value match the value used for discovery. The use
of this parameter is left to the Identity Provider's discretion. </span><span style="font-family:"ProximaNova-Regular",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-family:"ProximaNova-Regular",serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">This parameter must be encoded using binding-specific encoding rules such as a URL-safe query parameter for the HTTP Redirect
Binding or HTML form-encoded parameter for the HTTP POST Binding. The LoginHint MUST not be included in request signature for</span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"> the HTTP Redirect Binding</span><span style="font-family:"ProximaNova-Regular",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black">The Identity Provider MUST ignore the LoginHint parameter if the SAML Authentication Request message contains a </span><span style="font-size:10.0pt;font-family:"CourierNewPSMT",serif;color:black"><Subject> </span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black">with
an identifier and process the request message according to the SAML 2.0 Authentication Request Protocol<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Example<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="background:#FFFFCF;border-collapse:collapse;caret-color: rgb(0, 0, 0)">
<tbody>
<tr>
<td width="617" valign="top" style="width:463.1pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><br>
<span style="color:black">HTTP/1.1 302 Found</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Location <a href="http://idp.example.com/SAML?LoginHint=darinm%40amazon.com&SAMLRequest="><span style="color:purple">http://idp.example.com/SAML?</span></a><b><a href="http://idp.example.com/SAML?LoginHint=darinm%40amazon.com&SAMLRequest="><span style="color:purple">LoginHint=darinm%40amazon.com</span></a></b><a href="http://idp.example.com/SAML?LoginHint=darinm%40amazon.com&SAMLRequest="><span style="color:purple">&SAMLRequest=</span></a>...</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
</td>
</tr>
</tbody>
</table>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Karl<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>