Shibboleth Through the Browser Only

[Tom Scavo]

On Fri, Feb 28, 2014 at 2:36 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Tompkins,Charles R <crt at ufl.edu> [2014-02-28 01:35]:
>> Make sure you get the IdP and SP metadata exchanged out-of-band and
>> know when the IdP metadata changes.
>
> Entities shouldn't be pulling (probably unsigned) metadata from the
> other end anyway, firewall or not.

True, but Charles raises a good point: depending on firewall rules,
the metadata client inside the firewall may not be able to reach the
metadata regardless of its source.

Tom