Shibboleth Developers

["Scott Cantor" <>]

Adam Lantos wrote on 2009-07-14:
>  - HTTP connection using SSL with certificate validation from
> metadata. Client authentication will also be required, but since SP is
> behind a web server, it cannot force transport authentication, so
> request signing is a must.

There's nominally support in the SP for allowing it to be configured behind a 
dedicated SOAP port that would have client authentication enabled. But I 
don't think it actually can get access to the certificate on all of the 
platforms. So yes, signing is pretty much the only option.

-- Scott