How does it work?

High level description of the WAYF Cloud functionality

Every time a user visits a service provider page for the first time, a request is made by the user's browser to the WAYF Cloud URL, asynchronously and in the background, in order to notify the WAYF Cloud about the user visiting this service provider.

1. The user enters the URL of the service provider in a new browser window
2. The web page of the Service Provider loads at the user's web browser
3. A request to the WAYF Cloud is made asynchronously and in the background

Device Relationships

As the WAYF Cloud collects requests from the same web browser visiting different service providers, it builds relationships for this device similar to the ones illustrated in the following picture.

Relationships maintained in the WAYF Cloud

This graph consists of a node that represents the device as well as nodes for the different service providers this device has visited.

What's stored in the WAYF Cloud is a HASH of device IDs which are randomly generated at each service provider as well as a relationship between them, via another random id which is generated by the WAYF Cloud.

Hashing is performed in order to prevent that the data stored in the WAYF Cloud can be used to trace real users at the service providers platforms using their ID.

Sign in for the first time

When a user signs in for the first time to one of the service providers using the identity provider of their organization, the service provider platform shares the identity provider ID with other service providers by storing it in the WAYF Cloud. This data is associated with the device node as illustrated below

1. User signs in at the service provider using the identity provider of their organization
2. The Identity Provider ID is stored in the WAYF Cloud

Future Sign In attempts

A service provider can use the WAYF Cloud API to determine the organizational membership of a user, using the unique random identifier that the user's browser is locally known with at this service provider.

This process takes place in the background, requires no input from the user, and starts even before the user attempts to sign in at the service provider.

This mechanism can drive the design of a User Interface that simplifies the sign in process, even for users that visit a service provider for the first time!