Jetty deployment

[Scott Koranda]

Hi,

I agree. We use back channel attribute query quite a lot in support of
our collaboration management platform deployments. I do not find it
evil but instead rather elegant.

We also use artifact resolution quite a bit in LIGO--when it is
configured correctly it works quite well and provides a better browser
experience (no POST).

I have not replied before because I am working under the assumption
that the Shib dev team will not drop support for back channel
operations, even if they are not configured by default (I think
leaving it for "experts" to "turn on" is fine). Please let me know if
that assumption is not correct and I need to speak up more for back
channel operations.

Thanks,

Scott K

On Wed, Oct 1, 2014 at 11:10 AM, Eric Goodman <Eric.Goodman at ucop.edu> wrote:
> Not the place for the discussion, but I still think that it's going to more common in account linking scenarios (well, presuming such scenarios ever actually become prevalent), unless you want a login action to prompt the user for multiple different credentials (one per-IdP being queried).
>
> --- Eric
>
> -----Original Message-----
> From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Tom Scavo
> Sent: Tuesday, September 30, 2014 4:45 AM
> To: Shib Dev
> Subject: Re: Jetty deployment
>
> On Mon, Sep 29, 2014 at 7:53 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
>> * Ian Young <ian at iay.org.uk> [2014-09-16 19:58]:
>>
>>> I'd love to get to the point where disabling back-channel by default
>>> was practical. It causes pain we should be able to do without, at
>>> least until the next reason to use back-channel becomes prevalent.
>>
>> But those same publishers usually only recieve ePSA (in the UK) or the
>> common-lib-terms ePE (elsewhere), plus maybe ePTID.
>> Shouldn't be a hard sell recommending to push those over the browser.
>> (It's not like there are dozens of exploits waiting in your browser
>> only to learn your ePTID for ScienceDirect.)
>
> +1
>
> Back channel (attribute query, in particular) is just plain evil.
>
> Tom
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net