Shibboleth Developers

["Cantor, Scott E." <>]

> There is?  Are you talking about the 3rd-party requester thing?

No, the original SSO profile explicitly requires support for the unsolicited 
case. As I said, this is no different than what SAML 1.1 did. Step 1 is 
undefined because it was a matter for the IdP deployer, not a wire or 
inter-implementation consideration.

To be honest, I'm tired of defending my usual position on it. I'd be inclined 
at this point to just take the Shibboleth legacy protocol and use it for both 
protocols.

If and when we come up with justifications for signing requests (i.e., 
bypassing ACS checks), it just becomes something that only works in the 
SP-initiated case.

-- Scott