Shibboleth Developers

["Scott Cantor" <>]

> Sounds useful.  Here's just a minor thought:  I always worry about "a 
> separate URL"  getting out of sync or otherwise being different from 
> "the real URL."  Would it be possible to have a "reserved logon ID" 
> that would result in performing the checks ("pings") that you suggest 
> but at the real URL? 

No, because we don't control authentication. Even once we do, we can't
require it be deployed that way.

I think having distinct extension endpoints for implementation-specific
diagnostics is the proper way to do this, because then you don't have to
guess about whether something is real or not. It's easier to visibly shutoff
as well.

-- Scott