Shibboleth Developers

["Scott Cantor" <>]

> So, as Nate and I discussed, the real question comes down whether the
> ability to interoperate with the current profile is really necessary.
> My personal take is that if you're doing HoK you probably actually care
> that you are gaining the security benefits Nate has outlined in his
> profile.  I find the ability for an IdP to insert something like a
> bearer confirmation method in and basically silently destroy this added
> level of security, very disturbing.

I do also, I was going to note the same thing when he talked about "reusing"
the same endpoints.

By definition you can't use bearer here or it's a waste of effort.

-- Scott