Shibboleth Developers

["Scott Cantor" <>]

> If you're an IdP and you're concerned with pushing attributes on the
> front channel, and you can't (or won't) do encryption, why not support
> a push/pull combination where benign attributes are pushed and more
> sensitive attributes are queried on the back channel?  If the SP needs
> additional attributes, it can query.

If you're willing and able to use a back-channel, there's really no reason
to push anything. With 2.0, you can just use artifact, we already have to
build and deploy real state replication into the IdP anyway.

The cost of pulling data is that nobody can seem to manage to configure it
without tons of help from us, but maybe it will get a bit easier once we
have a Tomcat only install, don't know yet.

-- Scott