Push artifact binding for communication in a federated identity system

A method to communicate in a federated identity system comprising:

• for a service provider addressable through a Uniform Resource Locator, storing second Uniform Resource Locators corresponding to a plurality of services offered by the service provider in a federated identity record at a Domain Name Service;
• handling a federated action at an identity provider by:
• determining that a user request is to be conveyed to the service provider;
• retrieving one of the second Uniform Resource Locators from the federated identity record at the Domain Name Service corresponding to a federated service in the user request;
• and
• sending a request or assertion as a push message over a back-channel communication pathway to the service provider at the one of the second Uniform Resource Locators;
• handling the federated action at the service provider by sending a response to the message over the back-channel communication pathway to the identity provider including a third Uniform Resource Locator to which the user is to be directed;
• and
• redirecting the user to the third Uniform Resource Locator specified in the response.

A tangible computer readable storage device or storage disk comprising instructions to, at least:

• cause a controller in a service provider addressable through a Uniform Resource Locator to store second Uniform Resource Locators corresponding to a plurality of services offered by the service provider in a federated identity record at a Domain Name Service;
• cause a controller in an identity provider to determine that a user request is to be conveyed to the service provider;
• cause the controller in the identity provider to retrieve one of the second Uniform Resource Locators from the federated identity record at the Domain Name Service corresponding to a federated service in the user request;
• cause the controller in the identity provider to send a request or assertion as a push message over a back-channel communication pathway to the service provider at the one of the second Uniform Resource Locators;
• cause the controller in the service provider to send a response to the message over the back-channel communication pathway to the identity provider including a third Uniform Resource Locator to which the user is to be directed;
• cause the controller in the service provider to combine a unique identifier equivalent to an artifact binding into the third Uniform Resource Locator to which the user is to be directed;
• and
• cause the controller in the identity provider to redirect the user to the third Universal Resource Locator specified in the response.