Shibboleth Developers

["Scott Cantor" <>]

> > There is no interoperable way to do the encryption
>
> what about just signing the Request then? and letting tls continue to
> handle the confidentiality? without client-auth, as the 
> validation is done at the message level?

That's fine, but we still need replay detection. And what exactly have we
gained? Slowness? ;-)

-- Scott