Shibboleth Developers

["Scott Cantor" <>]

>   Thank you Scott - Not having implemented Shib (yet), I was under the
> (seemingly mistaken) impression that POST'd content to a <Location>
> containing "AuthType Shibboleth" would first be checked by mod_shib to
> look for SAML, and otherwise passed through.

The auth type dictates whether mod_shib looks for a session cookie, but has
nothing to do with SAML protocol messages. Those are dealt with at the
handler location(s) (/Shibboleth.sso/Foo) and that's what uses
getRequestBody.

If I tried to redirect POSTs on timeout, then I'd have to solve this
problem, and since it can't be solved in IIS 5 or 6 at all, I haven't
bothered so far.

-- Scott