Shibboleth Developers

["Scott Cantor" <>]

 wrote on 2009-03-30:
> That is a use case, I am very much interested in.  All 3 of the
"scenarios"
> I mentioned were effectively that use case, with various trust issues.
> Perhaps those trust issues are not considered relevant; regardless I'll
post my
> comments to the SSTC list.

They're out of scope of this proposal, but as I responded to your comments,
your use cases seem to involve forwarding or proxying (in the SAML 2
parlance), rather than delegation via an IdP.

The kind of delegation we're talking about is similar to how Kerberos
delegation works or CAS proxying works, issuing new tickets from the KDC (or
CAS server) that enable a service to act as the original user when accessing
another service.

-- Scott