Leif, I got your point.<div>The username+password for linux authentication was our point of start because usually Linux systems authenticate users this way.</div><div>However I share with you your concern about the philosophy and general architecture of Shibbolet.</div>
<div>One modification we are trying to do to our code, is that of replacing the Basic Auth mechanism with the ECP profile (used in different other projects in this area on Shibboleth).</div><div><br></div><div>Would you think that using SAML ECP profile we would be able to obtain our goal without a significant modification of Shibboleth abstraction architecture?</div>
<div><div><br><div class="gmail_quote">On Tue, Sep 4, 2012 at 2:53 PM, Leif Johansson <span dir="ltr"><<a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<div class="im"><br>
<br>
> We would really appreciate feedback on the work done in order to<br>
> understand with the community if the direction taken is good or if<br>
> some review may be suggested. Thanks and regards,<br>
<br>
</div>My problem is that this assumes that the IdP uses username & password.<br>
<br>
This is an increasingly invalid assumption, for instance as sites roll<br>
out ADFS2 which uses Negotiate instead of Basic.<br>
<br>
The point of SAML is to have an abstraction layer, so that relying<br>
parties could move beyond passwords.<br>
<br>
This breaks that abstraction layer.<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Mozilla - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
iEYEARECAAYFAlBF+boACgkQ8Jx8FtbMZndtBACeKFfmFkYZJhBggKX/tho4nTR8<br>
hoUAn2GhY1DLuh8B0IwE3ICbOA/mGTiI<br>
=P5A8<br>
-----END PGP SIGNATURE-----<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
<br>
</blockquote></div><br></div></div>