Shibboleth Developers

[Jim Fox <>]

> Agreed. Though its tempting to try and exploit this loophole. Right now, I
> know that if my login servlet can't figure out which SP the request came
> from, either the user bookmarked or I'm being framed. I've resorted to
> checking for frames and redirecting the user the main SP resource if I'm
> framed since by that time, I've lost any AuthnRequest info.

Are you trying to allow an IdP login from within an iframe?  How would the 
user verify the IdP's URL?

Jim