Shibboleth Developers

["Scott Cantor" <>]

> Why?  What's the app going to do with this public key?

I don't think we know enough to answer that question. For one thing, that
STS is usable with holder of key credentials on non-browser scenarios.

> We don't deliver to
> apps the credentials used by IdPs when they authnticate.

No, but that's because the SP's job is to authenticate the IdP for the
application. Here it can't do that.

> Seems to me that
> this credential is nothing but a validation that the other information
comes
> from the same user as used the site before.  I suggest that a 128 bit
> hash of the public key ought to be enough information.  It's an identifier
> and nothing more.

I don't think there's any reason to reduce the amount of information
provided when it's easier to provide the actual key. You're starting (I
think) with a KeyInfo that the C++ code already knows how to turn into DER.
Giving it something else is more work, not less.

-- Scott