Shibboleth Developers

["Cantor, Scott E." <>]

> I need it in both - I'm checking the value (an AuthnContext) against the
> requestedAuthenticationMethods in the LoginHandler in order to determine
> to which of two RemoteUser servlet endpoints to redirect to, and I need
> it in the servlet to set the AUTHENTICATION_METHOD_KEY attribute on the
> way out.

Isn't that transactional though? Wouldn't you need a way to prevent somebody 
from rerouting their traffic to the "other" servlet on the way back to 
distort their results? Seems like there would need to be something in the way 
you're picking up the results of the external SSO to ensure the method chosen 
is the right one.

-- Scott