Shibboleth Developers

[Peter Williams <>]

Out of interest, if the IDP (or the authentication provider) receives a 
request with ispassive=true and there is no existing local security context 
at the IDP (or authentication provider), should the IDP be sending back a 
formal SAML error?

Is this what Shib IDP does?

Is this common practice in the websso profile community?

Is there any writeup anywhere on what motivates Shib SP to handle inbound 
errors the way it does?

-----Original Message-----
From: Scott Cantor 
[mailto:]
Sent: Friday, October 10, 2008 7:21 AM
To: 

Subject: RE: [Shib-Dev] Writing an IDP extension

> You mean that if my LoginHandler does not implement isPassive or
> forceAuthn the IDP will "emulate" them for me? Because I want my IDP
> to support them.

No, it only does the work of preventing you from getting control if they're
specified and you don't support them. If you want to support them, you need
to build a LoginHandler that can honor them. If the eventual protocol that
handles SSO can't support them, you can't really do that.