Shibboleth Developers

[Tom Scavo <>]

The Shib spec holds out the possibility of an authentication authority
that responds to AuthenticationQuery requests.  We may have a use case
for AuthenticationQuery.

Suppose we integrate MyProxy, an online credentials repository and CA,
with a Shib IdP:

http://grid.ncsa.uiuc.edu/myproxy/

When a (non-browser) grid client requests a proxy certificate, MyProxy
registers the DN with the Shib authentication authority (with TTL
equal to that of the proxy cert).  Later, when the grid client
authenticates to the grid SP, an AuthenticationQuery with an
X509SubjectName identifier is issued to the authentication authority. 
In response, the grid SP receives an authentication assertion.  In
addition, the authentication authority pushes an attribute assertion
in the response.  (Alternatively, the grid SP could make a separate
request for attributes at a later time.)

Thoughts?

Thanks,
Tom