Shibboleth Developers

[Scott Cantor <>]

> Target or a bridge function at the Origin. One thing that I would add is 
> that if  x509 is the requirement for the asserted auth method, then it 
> would be useful on the target side to request the authenticator's public 
> key for logging purposes.

That could be done either as a Shibboleth attribute or by exploring the
X.509 client cert approach whereby the target would actually accept the
certificate during TLS.

It would be a little weird, but I could imagine a target actually doing
client cert authn *and* the SAML profile, with the latter being used to
actually setup the session, but the former used to log the public key.

-- Scott