I assume you've already heard about this, but just in case you haven't: http://www.nds.rub.de/research/publications/BreakingSAML/ Shibboleth is mentioned (implicated?) in this research paper. Tom