Shibboleth Developers

[Scott Cantor <>]

> For Shibboleth to become a heavily used 
> authentication/authorization system, it probably is time for 
> a lot more thought to be given to the user 
> support/help desk sort of questions that will arise. Generic 
> messages like the below are fine for pre-version 1 and/or not 
> widespread deployment, but eventually such messages need to 
> include real email address/help contacts that the user can 
> contact. Just like our WebISO systems do.

Couple points...this is a pre-version 1.0 message, intended to take the place 
of a really bad message in the current code. We're
just interested in introducing some less technical language into the 
discourse. Secondarily, we have some support for embedding help
addresses in the errors, but we haven't had time to spend on the UI up until 
now.

I'd like to see much more focus on the WebISO aspects of Shibboleth, and this 
is just one piece of that work, but as long as the
project isn't about WebISO per se, I think I'm going to be on that limb by 
myself for a while.

> As suggested above, one way to handle this is to have a help url 
> registered for each domain, and a standard url the target side can 
> construct to direct the user to a service that provides that 
> url for each registered domain. (Or maybe the help url is 
> encoded in the certificate(s) used for a domain with 
> Shibboleth? Is that possible?)

I agree with most of that. Personally though I prefer not to use certs for 
anything I don't have to, however. This project has
proven all my fears about certs true, and a few I hadn't been afraid of.

-- Scott

------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--