Shibboleth Developers

["Scott Cantor" <>]

> We have exactly the same concerns at K.U.Leuven. The artifact protocol
> requires an SP to have an entry in the metadata for any statement to 
> be released, so maybe there can be found an easy solution in that area: if

> it's possible to force all/unauthenticated providers to use the artifact 
> protocol then that issue could be solved easily in a Shib1.3 environment.

The fact that the old WAYF model makes using other protocols impossible
aside, no, there's no way to force it in 1.3 without changing the code, in
which case you just need to implement the trivial change of adding a "don't
allow unknown requests" option for POST.

-- Scott