Shibboleth Developers

["Dharam Veer" <>]

Thanks again. 

I see and understand how the extension to AuthnRequest is going to be. Seems to answer my needs perfectly.

On Mon, Oct 27, 2008 at 12:13 PM, Tom Scavo <> wrote:

On Mon, Oct 27, 2008 at 12:49 PM, Dharam Veer <> wrote:
>
> Thanks for this clarification. I am looking at OAuth as per your suggestion
> and it does look interesting. I hope that it has some way to establish trust
> using x509 like SAML.

I'm only an interested bystander (i.e., I have no intimate
understanding of OAuth) but I found these blog entries enlightening:

http://www.hueniverse.com/hueniverse/2007/09/explaining-oaut.html
http://www.hueniverse.com/hueniverse/2007/10/beginners-guide.html
http://www.hueniverse.com/hueniverse/2007/10/beginners-gui-1.html
http://www.hueniverse.com/hueniverse/2008/10/beginners-guide.html
http://www.hueniverse.com/hueniverse/2008/10/beginners-gui-1.html

Sharing of keys is assumed, not specified.

>>> The OASIS SSTC
>>> has discussed the possibility of including attributes in AuthnRequest,
>>> and in fact, this is an action item waiting for someone to write the
>>> profile.
>
> Is there any public link which talks about it ?.

Yes:

http://lists.oasis-open.org/archives/security-services/200805/msg00024.html

Follow the link therein for additional discussion.

Tom