Shibboleth Developers

["Scott Cantor" <>]

> Is there a specification for such a service?  (Even a short
> explanation would help :)

Well, Yahoo definitely gets at the flavor. Basically, some Java or PHP or
whatever with a database that manages self-registration with various options
like zero-assurance, and email-verify-loop, stuff like that.

The goal is to try and show that applications that need "local
authentication" could just as easily ship something like this in the box,
and the app could stop doing authentication itself and rely on the web
server.

My choice would be to put the "local" accounts behind a SAML IdP, but that's
a personal choice. The main thing is just to provide some infrastructure for
apps to use instead of building it in.

-- Scott