Shibboleth Developers

["Scott Cantor" <>]

> Tom Scavo wrote:
>> Spring supports OAuth
>> 
>> http://spring-security-oauth.codehaus.org/index.html
>> 
>> so that does that mean Shibboleth may one day support OAuth (whatever
>> that means) as well?

If you can come up with any context in which Shibboleth and OAuth overlap, 
I'd be happy to hear it. I haven't come up with anything. (They compose just 
fine, I'm speaking more about why there's anything Shibboleth should do.)

OAuth operates fundamentally on the premise of a service issuing access 
tokens to itself. There's no obvious role for an IdP to play, and if you try 
and inject one, you end up with something that looks an awful lot like SAML 
to me.

-- Scott