Shibboleth SP migration plan

[Cantor, Scott]

> Which reminds me, does IdP V3 support inbound HTTP-Artifact (or
> outbound artifact resolution, however you want to think about it)? Is
> it enabled out-of-the-box?

Not yet, a secure SOAP client wasn't ready for 3.0 (I define "secure" as "uses trust engines and metadata for authentication").

3.1 appears to be a bug fix with some API additions, so it will probably be in 3.2 or whatever the first actual feature update is in the next couple of months. I imagine it will be enabled for completeness, but I can't imagine it getting used much. It's just easier to test that SOAP use case than logout is. I wouldn't be surprised if the SP's implementation turns out to be broken anyway, it's never been exercised.

-- Scott