Shibboleth Developers

["RL 'Bob' Morgan" <>]

On Thu, 24 Apr 2003, Scott Cantor wrote:

> Also, I was being a bit flip in reference to a comment Phill H-B made
> (after not really being around for weeks) that SAML "clearly would
> change radically because of all the things that needed to be done to
> make it fit the WS-* world", which was not a comment I took great
> comfort in.

Ah yes, the WS-* world, a regime change of sorts, which seems more
inevitable to some than to others, I expect.

> It's largely orthogonal to SAML 1.1. The actual signature verification
> in 0.8 is reasonably sound, for just the POST profile (whereas signing
> assertions is effectively not supported).

Eh, but the POST contains a signed authentication assertion, yes (or
signed assertion containing an authn statement, to be precise)?  You're
saying that attr assertion signing is broken?  Then how can authn
assertion signing be working?

> But I am sure that staying with 0.8 is a bad idea for targets, and so if
> one posits that origins will want the 1.0 AA functionality (I would even
> if I was using LDAP), interop doesn't seem that crucial to me except for
> demos. Particularly since Ebsco is going to be getting fresh code, not
> 0.8.

Right, origins will want the new stuff, so interop with 0.8 origins isn't
a big priority.

So unless others object I'd say go for it and we'll get the guys in
sharkskin to explain why it's better this way ...

 - RL "Bob"


------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--