Shibboleth Developers

[Ian Young <>]

Scott Cantor wrote:

> > We did some informal side-by-side testing of Artifact+push vs. 
> > POST+query a while back, and found that the Artifact+push case was 
> > noticeably faster for us.  I suppose the amount of improvement probably 
> > depends on the speed of the machines involved, though.
>
> It mainly depends on how you authenticate the callback and whether you sign
> for other uses. With signing, there will be little or no difference, in fact
> POST would be faster in most cases, just not by much.

We were just comparing the two obvious cases for Shibboleth 1.3, no 
complicated stuff.  If we can encrypt the POST in 2.0 and therefore use 
POST+push with no callback, I can see how that might change the game 
completely.

> > Another attraction is that you don't see the "we're redirecting you" 
> > page flash by, which is a win from a user education point of view.
>
> Just make it blank.

D'oh!

        -- Ian