Shibboleth Developers

["Scott Cantor" <>]

> As I said, we have a use case that could leverage this feature today. 
> It involves the GridShib-myVocs integration we're working on with UAB:
> 
> https://authdev.it.ohio-state.edu/twiki/bin/view/GridShib/MyVo
csGridShibIntegration
> 
> In myVocs, the web application behind the SP is the IdP.

I'm not seeing what that has to do with signed assertions or forwarding, and
if you're saying "today", there's nothing you can forward, even if it were
signed.

The SSO assertion expires in minutes and a Shibboleth attribute query
doesn't produce a forwardable assertion (except between the SP and the
applications local to it of course, but that doesn't usually require getting
at the raw XML).

Certainly your diagram is fine though, the IdP's right there, so it can get
whatever attributes the SP in front supplies to it.

-- Scott