Shibboleth Developers

[Peter Williams <>]

This exchange is interesting:

> Whether an SP is authorized to process such a "response" is an entirely
> different question.

No, it's required to if it supports the profile.

-- Scott

I think you are saying that websso profile requires an sp to process 
unsolicited responses. That is, if I use my current products console to 
disarm support for handling at the sp unsolicited responses then the 
installation is no longer delivering the websso profile: its delivering my 
own (operational) sub-profile. It should not be considered conforming to the 
websso profile.

Is that a fair summary?