Shibboleth Developers

["Scott Cantor" <>]

> is this the "standard" for interop? Is there a reason why an attribute is
> prefixed with HTTP_SHIB?

Because that's what the default AAP does. There is no standard here, this is
the software -> application interface, the API if you will. The API in this
case is entirely at the discretion of the deployer except for a few of the
fixed headers.

> Presumably an application has to "bind" itself to a particular
> implementation of the Shibboleth profile. Either that or a standard is
> adopted in attribute naming in the headers.

A good implementation won't force the user into any convention, it's set at
configuration time.

-- Scott