Shibboleth Developers

[Scott Cantor <>]

Tom Scavo wrote:
> On 10/6/05, Scott Cantor 
> <>
>  wrote:
>
> > - supporting pseudonymity using transient subject names
>
> We've considered every NameIdentifier under the sun.  ShibHandle is
> just one possibility but X509SubjectName is still a strong contender. 
> As long as proxy certs remain transparent (with respect to identity),
> X509SubjectName makes a lot of sense.

Since the authentication credential itself is still X.509, I think 
that's pretty much a given, yeah.

> Yes, there's more support for NameIDs in SAML 2.0, but I don't think
> that's relevant for us since we're hoping for an implementation by the
> end of the calendar year.  Thus SAML 2.0 doesn't seem to be in the
> cards for us.

I know, but that wasn't my point. If you're going to invent new profiles 
or protocols in SAML 1.1, I'd just reinvent NameID mapping from 2.0, I 
wouldn't bother with authentication assertions that aren't being used 
for authentication.

-- Scott