Shibboleth Developers

[Ian Young <>]

Scott Cantor wrote:

> > On the other hand an RRA administrator who has to approve the SP
> > definition inspects the callback URL/endpoings, he (hopefully) would get
> > suspicious and reject the definition.
>
> So do that with the certificate submission. If you're claiming you need to
> issue a certificate, what you're really claiming is you want an out of band
> step. So add an out of band step. PoP in real time doesn't have to be that
> step, and I don't think it can be, not without transport authentication.

We've been thinking in terms of phoning up the contact and confirming 
the certificate fingerprint with them.

Just FYI.

        -- Ian