[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Subject: Re: Update: Contributed doc. browser bindings incl. Shibboleth
Tim,
To be perfectly honest, I have not given that much
thought as it does
not make sense in the B2B-schemes I'm plotting
with. Do you mean
like going to some other place where the same auth*
should work
as well? Using the "plain-Jane" scheme on
page #3 you could
do that. But iff the auth* also contains the target
URL as well, it should
be blocked at other sites. For other
reasons, like URL-breakage,
we don't actually propose such schemes, but rather
a Shibboleth-like
approach (page #4) which is a strong-binding truly
bi-directional auth* that does
not have any value except between a user and
his/her AA and the RP.
Regards
Anders
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Powered by eList eXpress LLC