Shibboleth Developers

["Scott Cantor" <>]

> Perhaps I'm not understanding the problem enough (probably) but would it
> help if the SP signed SAML Requests? Then it's client cert ends up in the
> SAML request and can be extracted by the AA and validated. TLS can still
> handle the wire, though it too could be binned if message-level encryption
> was used.

There is no interoperable way to do the encryption until 2.0, and we'd also
have to add replay detection/caching to prevent replay attacks.

-- Scott