Shibboleth Developers

["Scott Cantor" <>]

> That's an interesting question.  I don't how you could tell a 3rd-party
> initiated request from an SP-initiated one, at the IdP, unless you
> required signed requests (which we don't).

Well, we don't by default, that's up to the deployer. But the answer is, I 
proposed an extension for either unsigned or signed requests that 
distinguishes them, and makes it possible to make the mechanics all work 
without violating the profile.

Sometimes it takes people a while to figure out why I propose things. ;-)

-- Scott