Single hop federation

[arndt-s]

Deployment may want to do federation in a single hop. Currently, the document describes a 2 hop federation (First get assertion grant, then present assertion to domain B).

Do we have specific warnings, drawbacks, etc. for this use case? Do we want to describe it?

Just writing down what comes into my head:

Drawbacks

• AS of domain A loses control
• Domain B does not know if federation is intended
• Presented assertion may have been stolen (if not key bound)

However:

• federation is more resilient (AS of domain A does not need to be available)
• COGS of AS in Domain A can go down significantly (if federation is primary use case for example)
• Privacy?! AS of domain A does not know what clients federate to