Shibboleth Developers

[Scott Cantor <>]

> *Potentially* yes, but with the EAP-types I mentioned (TLS, TTLS and 
> PEAP) the user's password is only visible to the home authentication 
> server. With beforementioned types a secure tunnel is set up between the 
> client and the home authentication server, no intermediary server can 
> see the credentials.

Ok, didn't understand that. So in the TLS case, you're doing the CONNECT
trick that lets HTTP proxies handle SSL without getting in the middle?

> fair enough, security *always* is a trade-off. But in this case, you're 
> only forced to give your password to your own institution. 

Yes, that's fine.

> Hope this clarifies things.

Enormously, yes.

-- Scott