OpenSAML user discussion

["Scott Cantor" <>]

> How do you do your symmetric key exchange?  In particular, how do you get
> the shared secret between the subject (the user) and the SP (the service)?

How does Kerberos do it? By hashing a password into a key, right? Have the
authority issue an assertion with the confirmation key wrapped in the
principal's key, then the principal enters the password, the client decrypts
the confirmation key and uses it to generate the proof of posession to
confirm itself as the subject to the SP.

I'm sure there are lots more details to get right. I'm not advocating doing
it, I'm just saying it's technically possible.

-- Scott