HTTP-only ACS URL

[Russell Beall]

Thanks everyone for all the useful insights.  It seems clear that a POST response is out-security without HTTPS, so I think we will not release that to production.

Artifiact binding was mentioned as a workaround.  We have kept around the clustering, without actually fully needing it, so that we could support things like Artifact binding if it ever came up.  Is Artifact binding actually a reasonable work around meant for a situation like this, or should we not bother considering it?

I've never fully understood what the actual use case for Artifact binding would be, so I don't know its relevance to this situation...

Regards,
Russ.

On Aug 2, 2011, at 1:13 PM, Chad La Joie wrote:

> Yes, the whole premise is based around things that are bad.  There is
> a reason people get warnings when they try to do stuff like this.
> 
> On Tue, Aug 2, 2011 at 16:04, Tom Scavo <trscavo at gmail.com> wrote:
>> On Tue, Aug 2, 2011 at 3:52 PM, Chad La Joie <lajoie at itumi.biz> wrote:
>>> The only thing I could think of doing
>>> that would enable this (but should scare your users) is to server up
>>> the login page via HTTP but adjust the login page to submit to HTTPS.
>>> That would, I think, keep the credentials secure...
>> 
>> That, it would seem, would encourage phishing since a
>> man-in-the-middle could substitute a bogus URL in the HTML form.
>> 
>> Tom
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
> 
> 
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net