Shibboleth Developers

[Scott Cantor <>]

On 11/20/03 4:51 PM, 
""
 
<>
wrote:

> Its the other item -- "how you prove the right to use them"  -- that
> seems rather difficult in this case.
> 
> Can we imagine anything as "proof", beyond  possession of a short-lived 
> token?

It depends on the protocol, I guess. If you can get the client to include
assertions in the data stream, I don't know that it's that big a leap to
include a proof token or a symmetric signature.

But HTTP uses bearer tokens, so it's hardly unheard of.

-- Scott