Restful API to authenticate

[Cantor, Scott]

Shibboleth is not an authentication API. It provides specific functionality involving authentication "in service of" obtaining tokens (SAML, OAuth) to use for third-party authentication. It would be a misuse of the product to try and make it something else and we do not encourage that.

More forward-looking, there's no future in password authentication. The only things still doing that are either end user scenarios which don't involve REST, or things that have no business being password based (and probably haven't for a decade or more).

-- Scott