Shibboleth Developers

["Scott Cantor" <>]

> Could you elaborate on this? Do you mean that the federation operator
> should authenticate the credentials presented by the TLS peer at the ACS
> URL before adding the entity to the federation metadata?

No, I mean that whether the location submitted is controlled by the right
people is at least as critical as anything else. It's the entire basis of
the profile's security (from the IdP point of view), in the sense that
encryption came later with 2.0, and is optional.

Of course, the intent of TLS was that you could use it for this purpose, but
we all know that doesn't work.

-- Scott