Shibboleth Developers

["Scott Cantor" <>]

> I just searched the wiki and didn't find anything on this
> MemoryListener... What is it and where can I find 
> documentation about it?

There's no documentation on any of this, I thought I said that up front.

Most of the shibd server is in the MemoryListener class. The RPCListener on
the server side just calls the MemoryListener methods to service the calls
from the client. If you plugin the MemoryListener into shibboleth.xml in
place of the RPCListener, then in theory there's no RPCs anymore, it's all
inline.

> But, alas, the POST profile is not an option for me as the HandlerURLs
> of the applications are on http (and moving them to https is not an
> option).

First of all, SAML isn't secure unless you use SSL there, so my advice is to
not bother with this at all.

But artifact should give you the same warning. I don't think it cares
whether it's GET or POST, does it? It shouldn't. If anything a redirect from
https to http should be more suspicious.

Anyway, if you can't eliminate the callbacks, the amount of change here
effectively kills any point in trying to reuse libshib-target at all. I'd
use zxid or reimplement your own.

-- Scott