Transfer to another site after Login

[Cantor, Scott]

On 8/27/14, 9:54 AM, "miki8757" <miki8757 at hotmail.com> wrote:

>Shibboleth server should function only to authentication
>Then it should redirect to another server with a parameter of  email.

No, it shouldn't. That's not secure. You can't just redirect away to some
other system, not without building or deploying another SSO protocol to
protect that exchange of data. Essentially you would need at minimum a
shared key and a MAC operation around the data being passed, and you
should never expose personal information on a URL anyway.

-- Scott