Page Comparison

...

• Is a SAML, OpenID, and IMI/InfoCard compatible RP
• Trusts these OpenIDs:
  • Yahoo, AOL, Google
• Trusts these SAML IdPs:
  • InCommon Federation (of which Ohio State is a member)
• Trusts these Infocards:
  • Equifax, Citigroup, Wave Systems, Acxiom

Flow

...

A

Flow A is one of the flows (see the end of this document for more flows):

1. The user clicks on a "sign in" button on the NIH site
   1. The addon reads some data that tells it stuff like:
   2. That the site is an RP for OpenID, IMI and SAML protocols (unusually it does not support username/password!)
   3. The list of attributes that the site wishes to receive and for each attribute the list of authorities that the RP trusts. In our case the site is going to request only a non-correlateable identifier (aka an IMI "PPID", OpenID "directed" identity, SAML "persistent" NameID) and that it trusts only Yahoo, AOL, Google, as well as Facebook, Equifax, Citigroup, Silicon Wave, Acxiom, and InCommon IdPs to issue this attribute
2. The add-on displays a login window.
   1. It prominently shows the following accounts that could be used immediately (because Alice has these accounts and the NIH site accepts these accounts):
      1. Google
      2. Ohio State
      3. Yahoo
      4. Equifax
      5. AOL
   2. Its also shows accounts that Alice could use if she first registered with these IdPs
      1. Acxiom
      2. Wave Systems
      3. Citigroup
3. Alice clicks on Google
4. Alice authenticates to Google
5. Alice agrees to share Google attributes with NIH

...

Step #5: Alice agrees to share Google attributes with NIH

Flow Diagram

Subflow "Flow A " (described and mocked up above) is this path through the overall flowthe red path: