Jetty deployment

[Ian Young]

On 16 Sep 2014, at 18:42, Tom Scavo <trscavo at gmail.com> wrote:

> On Tue, Sep 16, 2014 at 1:20 PM, Ian Young <ian at iay.org.uk> wrote:
>> 
>> On 16 Sep 2014, at 17:54, Rod Widdowson <rdw at steadingsoftware.com> wrote:
>> 
>>> OTOH I have a feeling that the UK federation (who are probably
>>> a major consumer) still has a grotesque overhang of SAML1 only SPs and I
>>> don't see that number dropping as fast as anyone would like.
>>> 
>>> Ian?
>> 
>> UKf has 82 SPs without SAML 2 support, which is about 8.2%.
> 
> FWIW, 1817/1866 = 97% of SPs in the InC Federation support SAML2.

I think the raw proportion is interesting, but it's hard to get from there to how many IdPs *only* access SAML 2 SPs. It just takes one SP being in the SAML 1 only camp to potentially cause problems for any given IdP. In the UK, because the publisher use case is much more prevalent than I understand it to be for InCommon, something in that 8% is almost certainly used by almost every IdP.

> I'd love to see back-channel disabled by default. Most new IdP
> deployments don't need it (and from a deployer's perspective,
> back-channel is costly). As we continue to traverse the long-tail of
> IdP deployment, I think we'll find that the majority of IdP
> deployments do just fine on SAML2 only.

I'd love to get to the point where disabling back-channel by default was practical. It causes pain we should be able to do without, at least until the next reason to use back-channel becomes prevalent.

Today, though, I don't think even a new IdP in the UKf *can* really survive without it, so on balance I'd prefer to retain the V2 stance of enabling it by default.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20140916/7fad4d80/attachment-0001.bin