Shibboleth Developers

["Scott Cantor" <>]

> I think you are saying that websso profile requires an sp to process
> unsolicited responses.

I *think* so. I may be misremembering, perhaps it's only a MUST on the IdP
side.

> That is, if I use my current products console to
> disarm support for handling at the sp unsolicited responses then the
> installation is no longer delivering the websso profile: its delivering my
> own (operational) sub-profile. It should not be considered conforming to
the
> websso profile.
> 
> Is that a fair summary?

No, I said an implementation MUST support it, I didn't say a deployment
MUST. I was talking about implementation conformance.

If you're saying that you think metadata should expose how the deployment is
set up, I misunderstood you. I'll only say what I always say...lots of
things aren't in metadata.

-- Scott