OpenSAML user discussion

["Scott Cantor" <>]

It's probably semi-relevant that I just submitted a new proposal for a
version 2.0 ECP profile:

http://wiki.oasis-open.org/security/SAML2EnhancedClientProfile

The main addition in this draft is support for channel bindings, which
allows the client to authenticate the web service through the IdP without
relying on what passes for authentication in the SSL world today.

I'll also be adding holder of key support in a later draft, which is
particularly useful for "SPs as clients" since they generally have keys.
This should give us something more like a Kerberos level of security instead
of passing around bearer tokens.

-- Scott