Jetty deployment

[Eric Goodman]

Not the place for the discussion, but I still think that it's going to more common in account linking scenarios (well, presuming such scenarios ever actually become prevalent), unless you want a login action to prompt the user for multiple different credentials (one per-IdP being queried).

--- Eric

-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Tuesday, September 30, 2014 4:45 AM
To: Shib Dev
Subject: Re: Jetty deployment

On Mon, Sep 29, 2014 at 7:53 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
> * Ian Young <ian at iay.org.uk> [2014-09-16 19:58]:
>
>> I'd love to get to the point where disabling back-channel by default 
>> was practical. It causes pain we should be able to do without, at 
>> least until the next reason to use back-channel becomes prevalent.
>
> But those same publishers usually only recieve ePSA (in the UK) or the 
> common-lib-terms ePE (elsewhere), plus maybe ePTID.
> Shouldn't be a hard sell recommending to push those over the browser.
> (It's not like there are dozens of exploits waiting in your browser 
> only to learn your ePTID for ScienceDirect.)

+1

Back channel (attribute query, in particular) is just plain evil.

Tom
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net