Shibboleth Developers

["Alistair Young" <>]

> There is no interoperable way to do the encryption
what about just signing the Request then? and letting tls continue to
handle the confidentiality? without client-auth, as the validation is done
at the message level?

Alistair


-- 
Alistair Young
Senior Software Engineer
UHI@Sabhal
 Mòr Ostaig
Isle of Skye
Scotland

>> Perhaps I'm not understanding the problem enough (probably) but would it
>> help if the SP signed SAML Requests? Then it's client cert ends up in
>> the
>> SAML request and can be extracted by the AA and validated. TLS can still
>> handle the wire, though it too could be binned if message-level
>> encryption
>> was used.
>
> There is no interoperable way to do the encryption until 2.0, and we'd
> also
> have to add replay detection/caching to prevent replay attacks.
>
> -- Scott
>
>