Shibboleth Developers

[Scott Cantor <>]

> I think we need some clarification here on the MS side of the 
> house because on the server side of things ASP is the primary 
> server tier for .NET (I'm spending a lot of time these days 
> working with .NET, though mostly on the client end).

ASP+ is. ASP is not. I was trying to make a distinction there. Particularly
with respect to the higher-level .NET security pieces. My guess is Microsoft
has those well and truly hard wired to AD.

> For Windows - we should probably be aiming at a short-term 
> solution being a COM component that provides the general Shib 
> services as we're defining for Java target. At a very 
> high-level -- we pass the COM component an HTTP session of 
> some type (ie output stream, plus the HTTP request headers) 
> and it comes back with the Shib target stuff.

I would guess we can take the eventual interface defined for the Java
"logical session" object and do it in COM without too much work. Java
language interfaces and COM interfaces are fairly equivalent.

> COM then provides the most flexibility for exposing Shib 
> behavior to Windows server applications -- IIS filters, old 
> ASP, and .NET (aka ASPx which defaults to VB.NET for language 
> but can also use C#). While you should try to avoid COM when 
> programming with .NET (calling COM from .NET is a bit like 
> calling native code from Java, though much easier), it is 
> definitely possible.

Agreed.

-- Scott