Shibboleth Developers

["Scott Cantor" <>]

> The question comes up whether or not the binding in the relayed
> AuthnRequest HAS to be PAOS, or can it be any binding in the
> SP's metadata.  The actual binding at the IdP is always SOAP.
> The binding mentioned in the AuthnRequest would seem to be somewhat
> of a private matter between the ECP client and the SP, as they are
> the one's actually using it.

That's technically the case, but it would become the client's responsibility
to reformat the response into some other choice, and practically speaking
the only other choice would be POST, if you think about it a little.

-- Scott