Shibboleth and ACS

[Cantor, Scott]

On 2/13/14, 2:38 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>On Thu, Feb 13, 2014 at 2:10 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> ... some people seem to be under the misimpression
>> that what you put in the metadata at an SP somehow causes an IdP to do
>> something, or support something.
>
>Uh, I'm one of those people. I always thought that what I put in SP
>metadata *did* in fact affect the behavior of the IdP. In fact, I can
>put a certificate in my metadata that will cause *nearly every* IdP to
>send an encrypted assertion that can't be decrypted.

And you misread me. I said "put in metadata *at* the SP", not "put in
metadata about the SP".

That is, describing the IdP to the SP does not in and of itelf cause the
IdP to behave in accordance with that description. People very, very often
think that they "configure" an IdP or SP that way, rather than describing
the configuration they already applied in the metadata afterwards.

-- Scott