Shibboleth Developers

["Scott Cantor" <>]

> Thomas' point is well taken, however.  We must mitigate the
> possibility that a grid service could request attributes for any user.
>  Perhaps there is some comfort in the fact that the DN in the proxy
> cert is short-lived, so if we make sure that the DN binding at the IdP
> expires along with the proxy cert, this is good enough.

The LionShare approach to this is (I think) to use something like the
current crypto handle plugin to generate an encrypted string containing the
principal and expiration data and then have the AA plugin decrypt that to
recover the identity. It just requires that the CA issuing the short-term
cert have the plugin to generate that DN.

-- Scott