minimal/no backchannel shibboleth idp configuration

[Cantor, Scott]

On 12/17/14, 12:15 PM, "Tom Scavo" <trscavo at gmail.com> wrote:


>
>- An IdP should avoid SAML1 attribute query if possible. If an IdP
>must support SAML1, the IdP should consider pushing attributes via
>unencrypted SAML1 assertions on the front channel in lieu of attribute
>query.

I think the project view is that it's not our role to tell people it's 
safe to do that, it's just our role to explain what the trade-off is.

>- An IdP supports SP-initiated SAML2 flows by advertising a
>SingleSignOnService endpoint that supports the SAML2 HTTP-Redirect
>binding. Support for other bindings is optional and new deployments
>are encouraged to be conservative in this respect.

A non-trivial number of commercial vendors running garbage implementations 
require POST.

>- An IdP should avoid SAML2 attribute query altogether. (I've never
>known an IdP deployment that actually needed a SAML2 AttributeService
>endpoint in metadata.)

VOs use them quite a bit.

-- Scott