Shibboleth Developers

["Tom Scavo" <>]

Some links to development notes have appeared on the Shib 2 Roadmap:

https://authdev.it.ohio-state.edu/twiki/bin/view/Shibboleth/ShibTwoRoadmap

These notes are much appreciated, thanks.  One topic in particular
caught my eye:

https://authdev.it.ohio-state.edu/twiki/bin/view/Shibboleth/WAYFDev

Is this a design for a per-SP discovery service?  This seems to be the
case since the protocol doesn't require the unique identifier of an
SP.  Also, since the return URL is arbitrary, how do you prevent a
rogue SP from spoofing the user to divulge their preferred IdP?

I'm not sure what a "SAML IdP cookie" is, but does this service
support the SAML2 Common Domain Cookie (CDC)?  Will the CDC Reading
and Writing Services be implemented?  (It sure would be nice to have
servlet filters that implemented the CDC Reading/Writing Services.)

To integrate with the SessionInitiator at the SP, would it be better
to call the output parameter 'providerId' instead of 'entityID'?  Then
the return URL could point to a (lazy) SessionInitiator endpoint (or
maybe I'm misunderstanding the purpose of this new service).

Thanks,
Tom