Shibboleth Developers

["Cantor, Scott E." <>]

> RFC 5929 is somewhat pertinent here. I'm not sure if/what TLS
> implementations already expose tls-unique to the app, though (cf. also
> section 7 of said RFC).

Very few. Java is not one of them (I asked Nico a few months back). OpenSSL 
does, but libcurl on top does not. GnuTLS does.

I'm still thinking though that once you bind the channel, you still need an 
application layer mechanism to recognize whether the channel still holds, if 
you're not using a single TCP connection.

To focus on the point of this thread, though, the protocols we're generally 
using between the browser and the IdP don't offer channel bindings. Chad was 
just using it as an example of the thinking behind exploring the use of the 
TLS connection for a session.
 
-- Scott