Jetty deployment

[Cantor, Scott]

On 10/1/14, 12:36 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>
>I agree. We use back channel attribute query quite a lot in support of
>our collaboration management platform deployments. I do not find it
>evil but instead rather elegant.

I think it's fine for sufficiently skilled deployers (I'm not talking
rocket science, just bare minimum competence).

>I have not replied before because I am working under the assumption
>that the Shib dev team will not drop support for back channel
>operations, even if they are not configured by default (I think
>leaving it for "experts" to "turn on" is fine). Please let me know if
>that assumption is not correct and I need to speak up more for back
>channel operations.

I don't think they're even being turned off by default based on the
feedback, but no, they're not going anywhere. On top of which, the CAS
support is a backchannel, and so is OpenID in the future, as much as I
detest that choice.

Backchannel won, SAML's the outlier at this point. But it won because
people can implement it with no security and pretend. For those of us not
willing to implement like that, we have a harder job and more constraints
as a result. The back channel for example is the primary reason I'm tied
to OpenSSL.

-- Scott