Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# DRM Sign-in: Liberty Alliance example

The Liberty Alliance standard supports HTTP GET and POST operation for DRM Sign-in

# HTTP GET Operations

This is the content for the HTTP GET DRM SSO Sign-in (Authentication Request) operation.

    https://authenticate.gateway.gov.uk/Protocols/Liberty/DelegatedSignin.ashx?
    RequestID=48ea85a3-743f-5e28-1aa2-d176ba17ef14&
    MajorVersion=1&
    MinorVersion=2&
    ProviderID=[Target Resource]&
    IssueInstant=2007-02-16T19:18:30Z&
    ProtocolProfile=http%3A%2F%2Fprojectliberty.org%2Fprofiles%2Fbrws-post&
    consent=urn:liberty:consent:obtain:prior&
    lang=[Language]&
    token=[One-time Token]&
    signouturl=[Sign-Out Address]

# HTTP POST Operations

This is the content for the HTTP POST DRM SSO Sign-in (Authentication Request) operation.

    <form action=https://authenticate.gateway.gov.uk/Protocols/Liberty/DelegatedSignin.ashx method="post">
      <input type="hidden" name="LAREQ" value="[Base64 encoded Authentication Request document]" />
      <input type="hidden" name="RelayState" value="State information to be persisted across operation" />
      <input type="hidden" name="lang" value="[Language]/>
      <input type="hidden" name="token" value="[One-time Token]" />
      <input type="hidden" name="signouturl" value="[Sign-out Address]" />
    </form>

Authentication Request document

    <?xml version="1.0" encoding="utf-8" ?>
    <lib:AuthnRequest RequestID="9abc25ad-883f-411c-1aff-e1246ba17db6" MajorVersion="1" MinorVersion="2"
    IssueInstant="2007-02-16T19:18:30Z" consent="urn:liberty:consent:obtained:prior" xmlns:lib="urn:liberty:iff:2003-08">
      <lib:ProviderID>[Target Resource]</lib:ProviderID>
      <lib:ProtocolProfile>http://projectliberty.org/profiles/brws-post</lib:ProtocolProfile>
      <lib:RelayState>[RelayState]</lib:RelayState>
    </lib:AuthnRequest>

This is the response produced by the CAP for a DRM Sign-in (HTTP GET or POST)

    <form id="gatewayRes" method="post" action="[Reply Address]"
      <input name="LARES" type="hidden" id="LARES" value="[Base64 encoded AuthnResponse]" />
    </form>

AuthnResponse includes the SAML Assertion (this is not for the target Portal):

    <lib:AuthnResponse
      InResponseTo="48ea85a3-743f-5e28-1aa2-d176ba17ef14"
      IssueInstant="2007-02-16T19:18:30Z" MajorVersion="1" MinorVersion="2"
      ResponseID="1400cea1-7d54-4501-9735-35569fd2f544
      xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
      xmlns:lib="urn:liberty:iff:2003-08">
      <samlp:Status>
        <samlp:StatusCode Value="samlp:Success" />
      </samlp:Status>
      [SAML Assertion]
      <lib:ProviderID>[Target Resource]</lib:ProviderID>
      <lib:RelayState>State information to be persisted across operation</lib:RelayState>
    </lib:AuthnResponse>

AuthnResponse returns an error

    <lib:AuthnResponse
      InResponseTo="48ea85a3-743f-5e28-1aa2-d176ba17ef14"
      IssueInstant="2007-02-16T19:18:30Z" MajorVersion="1" MinorVersion="2"
      ResponseID="1400cea1-7d54-4501-9735-35569fd2f544
      xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
      xmlns:lib="urn:liberty:iff:2003-08">
      <samlp:Status>
        <samlp:StatusCode Value="samlp:Responder">
          <samlp:StatusCode Value="samlp:RequestDenied" />
        </samlp:StatusCode>
        <samlp:StatusMessage>The security token could not be authenticated or authorized</samlp:StatusMessage>
      </samlp:Status>
      <lib:ProviderID>[Target Resource]</lib:ProviderID>
      <lib:RelayState>State information to be persisted across operation</lib:RelayState>
    </lib:AuthnResponse>

Notes:

- ProviderID: Contains the Target Resource which reference a Portal Resource File (configured for the organisation) – this includes the Reply Address URL (i.e. within the corporate application) to which the browser will redirect the response. Note this is not the Target Resource for the target Portal.
- RelayState: State information to be persisted across operation (not used or modified by CAP). If the RelayState element is not defined within LAREQ, CAP takes the content of the RelayState parameter instead. This content is returned in the response.
- lang: Identifies the language for displayed pages. For example en-GB for English and cy-GB for Welsh. It is used in in conjunction with the Target Resource value to qualify the Portal Resource File to be used.
- token: Contains the One-time Token returned from GsoDelegateRights. It is used to authenticate the corporate user.
- signouturl: Contains the Sign-out URL to return to when the corporate user signs out.
- The SAML Assertion will be returned using the Liberty IDFF 1.2 protocol implementation. However the primary significance of receiving the assertion is to indicate the corporate user has been successfully authenticated – it cannot be use to directly get a GatewayToken.

© Crown Copyright 2008. All rights reserved