Shibboleth Developers

["Scott Cantor" <>]

>   I think you've got it, though I don't understand why you think it  
> only makes sense if the CA and IdP are in separate domains. From my  
> perspective bridging mechanisms has the same impact here as domains.

My sequence of steps involved authenticating to MyProxy with SAML. Tom's did
not, it assumed the MyProxy used the same authentication source as the SAML
IdP. That's not feasible unless the MyProxy is in the same domain as the
IdP.

In the former case, while I suppose you could invent a lot of new stuff to
enable use of SAML to authenticate to MyProxy, I don't think anyone would
bother if it shared a domain already with the authentication source.

That's why I think the domains matter.

-- Scott