Shibboleth Developers

Following up on last monday's shib-dev  conf call, and the 
conversation about diagnosing shib-related errors, I've spent some 
time reading thru the archives  for the shib-users mailing list.

I've tried to do a couple of things. First, here's a new draft FAQ, 
based on issues and questions that show up on that mailing list. In 
some cases, I've tried to rework the text into standard FAQ 
question/answer format; in other cases, the description and 
resolution followed a twisted path, and frankly this afternoon I 
don't have the fortitude to try and straighten them  out. Comments 
and suggestions and additions welcome.

http://stc.cis.brown.edu/~stc/Projects/Shibboleth/Version-3/Shib-FAQ-sorted.txt

The second task I tried to take on was to look at the PKI-related 
problems, and try to figure out whether the problems sorted into any 
convenient categories. One item that came up in last monday's 
discussion was whether using X.509 created more problems than it 
solved......

At this point, about all I'm willing to say is that diagnosing 
PKI-related problems is an  absolute mess. Its probably a mistake to 
try to develop FAQ  text for these problems by reading the  mailing 
list. It might make more sense to have someone deliberately 
misconfigure an origin/target pair, and  record the message that 
appeared, the log file contents, and the misconfiguration that 
produced those messages.