Shibboleth Developers

["Scott Cantor" <>]

> A Shibboleth IdP won't (can't) release ePTI to an SP that hasn't been
> authenticated, for example because it hasn't provided a credential on
> the attribute callback.

Yes, that's true. It's acceptable (though unlikely to be a good idea) to put
it in the default ARP, but that's one case where having it there won't work
if the request is anonymous. That falls into the "not successfully resolved"
bucket I mentioned in the last email.

If the logs aren't clearly indicating that, I'd file a bug.

-- Scott