Shibboleth Developers

[Steven Carmody <>]

On 1/3/11 2:19 PM, Cantor, Scott E. wrote:
> > There is no such thing as a IdP-first web browser profile so no the
> > IdP doesn't support it.  You'll have create a mock authn request
> > and send it to the IdP.
>
> I guess more precisely, there is a such a profile, but it contains an
> undefined step 1 (same one that was undefined in SAML 1.1, how you
> trigger it). We have no such support because we're (or at least I'm)
> reluctant to commit to defining such a step.

This is the second major vendor we've encountered that saw that text, 
and for their own reasons decided to go ahead and implement that profile.

If the vendor is dealing with a customer that isn't sufficiently 
SAML-savvy, you end up with what Mike described:

> Yale's work around
> describes the problem:
> http://isa.its.yale.edu/confluence/display/Shib/Add+IdP+Initiated+Post+SSO+Support+to+Shibboleth

Is there any sort of warning that could be associated with the undefined 
step 1, alerting implementers that this may not be supported in some 
deploys?