Shibboleth Developers

["Tom Scavo" <>]

On 5/13/06, Scott Cantor 
<>
 wrote:
> > Before I comment on this document, may I ask what is its intended use
> > in Shib 2.0 (if any)?
>
> If signed requests become de rigeur, then this extension is the only way
> that a portal or some other intermediary can issue interoperable signed
> requests on behalf of some SP to enable unsolicited SSO responses.
>
> You can think of it as a way of doing IdP-first triggers interoperably (as
> opposed to SAML 1.x where the link to the ITS was proprietary).

So let me see if I understand this.  A portal is protected by an SP,
so the portal knows the user's preferred IdP.  Instead of exposing
links to other 3rd-party SP-protected resources (which would require
IdP discovery), the portal handles all AuthnRequests itself, using the
extension mechanism to target the response to the 3rd-party SP.
Correct?

Tom