HTTP-only ACS URL

[Cantor, Scott E.]

On 8/2/11 4:36 PM, "Russell Beall" <beall at usc.edu> wrote:

>Thanks everyone for all the useful insights.  It seems clear that a POST
>response is out-security without HTTPS, so I think we will not release
>that to production.

We have lots of them around campus, FWIW, I just don't accommodate their
desire to get around the warning.

>Artifiact binding was mentioned as a workaround.  We have kept around the
>clustering, without actually fully needing it, so that we could support
>things like Artifact binding if it ever came up.  Is Artifact binding
>actually a reasonable work around meant for a situation like this, or
>should we not bother considering it?

It does work around the problem at the cost of, well, all the costs.

>I've never fully understood what the actual use case for Artifact binding
>would be, so I don't know its relevance to this situation...

Redirect based flows solve a lot of difficult problems, like this one, at
the cost of complex state and a back channel.

-- Scott