Shibboleth Developers

[Jim Fox <>]

I have never understood this concern.  If one uses https always aren't the 
pushed attributes encrypted?

Jim

On Aug 25, 2010, at 12:32 PM, Chad La Joie wrote:

> I would feel uncomfortable doing that.  It feels like it would be 
> encouraging a bad practice.  Like you I don't get super freaked about 
> pushing unencrypted attributes but I do feel it's not the ideal situation.
> 
> On 8/25/10 3:29 PM, Scott Cantor wrote:
>>> Well, I think the problem is that there is quite a large SAML 1 only
>>> install base right now and a lot of them aren't show much sign of
>>> moving.  We still know there are a significant number of folks running
>>> Shib 1.3 and many of the other opensource IdPs are are SAML 1 only.
>> 
>> I guess a compromise with possibly useful side effects is not supporting
>> queries, so people would have to push attributes in the client with no
>> encryption. That seems to bug people, so I guess that's a way of
>> accomodating without encouraging.
>> 
>> -- Scott
>> 
>> 
>> 
> 
> -- 
> Chad La Joie
> http://itumi.biz
> trusted identities, delivered