Shibboleth Developers

["Scott Cantor" <>]

Peter Williams wrote on 2009-03-30:
> What is the "impending problem" - that didn't exist 3 years ago with
> sufficient imperative?

Three years ago the goal was to get SAML 2 out the door, not deal with web
services and delegation.

Liberty didn't care about the result of handing a delegated assertion to
software that wasn't expecting it, because they had to assume entirely new
software to support web services. We're reusing ECP to support arbitrary
HTTP-based applications, which means we'd be potentially handing them to an
existing SP.

We don't like the idea of an SP silently accepting a delegated SSO assertion
without any intervention by the deployer, ergo the extension to identify
delegates has to have critical semantics. Conditions are the only extension
mechanism that do.

-- Scott