Shibboleth Developers

["Scott Cantor" <>]

> > Shibboleth identifiers are as SP-specific as you want them to be.
> 
> Could you explain a bit more what you mean?  (The target SP is not
> involved in the production or consumption of the identifier AFAIK.)

If that's true, then the API is broken, since we can't do federated IDs
without that parameter. I assumed if it was available to the attribute
resolver that it would be available to the ID resolver. I suspect it would
be a trivial hack to get it added in.

> Sorry, I failed to make things clear before...the CA *is* generating
> the key for the client.

Umm. That's not how the kX.509 thing works at Michigan, I don't think, so
why would anybody accept that? The client should generate the key and send
the public half up to the CA to get the cert issued...

> Okay.  So specifying Conditions to hold the TTL is the way to 
> go in this case?

Assuming you mean NotBefore and NotOnOrAfter, then yeah, that's probably
what I would do.

-- Scott