Federated authentication means that a user logs in on another location (an Identity Provider) than that of the accessed service (a Service Provider). SURFconext is located between those locations. Each of the providers has only one trusted connection with SURFconext: this is why this is called a hub-and-spoke federation. The connections are 'trusted', because both the Service Provider and the Identity Provider have identified themselves to SURFconext by exchanging metadata. These metadata contain all the information necessary for one entity to send a message to another (like endpoint locations, bindings and signing certificates).

SURFconext couples the SP and the IP depending on specific rules.

Note that SURFconext itself does not authenticate users: this is done by the connected Identity Providers.

Authentication process in steps

  1. A user accesses a Service Provider and is required to log in. The Service Provider redirects the user to SURFconext with a request to authenticate the user.
     
  2. In order to determine where to send the user for authentication, SURFconext shows the user a "Where Are You From?" (WAYF) page with all Identity Providers that have access to the service.
     
  3. The user chooses the institution that is his Identity Provider. After that he is redirected to that IdP with a authentication request.
     
  4. The IdP authenticates the user, usually by asking to enter his credentials. After validating, the IdP redirects the user to SURFconext with a response message, saying that the user is authenticated. The message also contains the attributes from the user.
     
  5. SURFconext validates the response message and if OK makes some alterations, e.g. rewriting the user's identifier and adding or modifying attributes. According to the attribute release policy applied, SURFconext determines the attributes that are allowed through to the Service Provider.
    The user is redirected to the Service Provider with a response message.
     
  6. The Service Provider validates the response message from SURFconext. If valid, the Service Provider can extract the necessary information and allow the user to access the service.