IdPv3 CAS Protocol Update

[Cantor, Scott]

On 4/2/13 1:16 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>That would be very helpful for authn, and generally for all flows that
>might be invoked outside their natural context. In order to accomplish
>a complete API description, there's a decision point (maybe the same
>or related to what Scott already mentioned about baseline metadata)
>about what capabilities are generic versus protocol specific. I can
>imagine that forced authn would be a generic capability, but there may
>be other candidates that are harder to determine.

I think the chief concern about using protocol-neutral constructs is that
we're worried about running into protocols for which we would be forced to
hack around or mock up data if we had code that was written "neutrally"
but was expecting certain data to exist.

I'm not sure that applies so much here. Something like a ForceAuthn
semantic is either true or false for a transaction, and in a given
protocol one would assume it's either true, false, or set based on a
request option.

-- Scott