Shibboleth Developers

["Tom Scavo" <>]

Ping Identity recently introduced the term "Dynamic Federation" and
has finally provided some details describing what they mean by this
term:

http://www.andredurand.com/2007/11/12.html#a761

Does Shib 2.0 provide similar metadata capabilities?

I find their approach to discovery even more interesting.  I don't
think an SP can derive a user's IdP from their e-mail address in
general.  Suppose, however, the SP obtains a valid e-mail address from
the user directly and then persists a mapping from this e-mail address
to a persistent identifier (ePPN or ePTID) asserted by the IdP.  Then
the SP *can* determine the user's IdP from an input e-mail address.
It's kinda like OpenID's approach to discovery, but using e-mail
addresses instead of URLs (which may even be more palatable to users).

Tom