Shibboleth Developers

["Scott Cantor" <>]

I should soften my response...I think I know of one way to effectively
produce something like an IdP-initiated flow. It would require that the user
first login to the IdP and then make some kind of interactive selection to
tell it to produce a response.

That sidesteps the signed vs. unsigned issue by guarding the mechanism with
the authentication step first, as opposed to enabling it from a client with
no regard for that.

Knowing how the commercial IdPs are implemented as gateways and portals,
that's what I've typically seen, so I'm sure that's what we'd have to do.

We definitely don't have that now, no. The reason is that in most cases,
what you want to be able to do is link to the IdP from *outside* it to tell
it "hey, produce a response to SP Foo". That is *not* IdP-initiated, and
that's the point I was trying to make.

-- Scott