OpenSAML user discussion

["Scott Cantor" <>]

> No, there's no pre-shared secret between the user and the SP, just between
> the user and the KDC.

I know. The SAML subject confirmation key would be the session key, it's the
KDC-supplied secret that both the parties can decrypt but nobody else can.

> Sure, but at this point you're re-inventing kerberos; why would you
> want to do that instead of just using RFC1510bis?

Of course, but that's precisely what the person was asking about. So yes,
it's possible, and no, I wouldn't do it.

-- Scott