Shibboleth Developers

["Scott Cantor" <>]

> David's point about fishing is well taken.  We have discussed adding 
> authZ regarding which SPs can use which NameMappings, but haven't 
> implemented it yet.  I think this is on the 1.3 TODO list.

Right, I think this is the only thing missing in terms of easily permitting
DN-based queries for stand-alone (i.e. no subject confirmation) assertions.
I use Kerberos-principal-based queries within OSU, but I had to actually
firewall off that listener and use a separate AA deployment because I can't
prevent arbitrary SPs from using it.

I think all that's needed is a unification of the RelyingParty constraints
on HS name mapping to cover the AA component.

-- Scott