Shibboleth Developers

[Peter Williams <>]

Or you use the (relevant?) "certificate-authentication" option of infocards, 
which drives a more palatable and modern "client TLS" experience.

Cert-auth is a composite system of 2 component assurances: in which the 
client cert used on the "outer" transport of the token has to match the cert 
supporting the "inner" signed saml token.

Think channel bindings, now, since one has the outer:inner pattern, and 
tokens handlers (like channels handlers) can be MITM'ed.

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Cantor, Scott E.
Sent: Wednesday, February 09, 2011 8:06 AM
To: 

Subject: RE: [Shib-Dev] Viability of SSL/TLS Session IDs usage for 
application Session IDs

 
Of course, if you use client TLS, that's a perfect solution, but not 
generally relevant.

-- Scott