AttributeScopeMatchesShibMDScope

[Ian Young]

On 27 Oct 2011, at 15:21, Cantor, Scott wrote:

> Of course, defaults are always open to discussion. If people felt the
> default shouldn't be to apply a rule that relies on an extension, that's
> open for debate.

Changing the default would of course change the security model of those SPs which rely (knowingly or, in many cases in my experience, unknowingly) on the current default being "check".  And by "change" of course I mean "completely break".

So, "open for debate" theoretically, but I think I'd predict (ahem) significant push-back from certain quarters if changing the default was seriously proposed.

Changing a default to *add* a protection is always much easier than changing it to *remove* one.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3661 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20111027/c71df31a/attachment.bin