ECP and determining Shibboleth "contact"

[Nathan Potter]

Greetings,

I recently completed working through an example SP (backed by the testshib IdP) utilizing the ECP profile. The ecp.sh example was useful in helping me understand what's going on, as was the ECP Profile Specification. 

However, I am left with questions:

1) How are clients expected to determine when the SP is initiating/requiring a Shibboleth authentication flow?

Specifically:

1a) How is a client to determine that when an SP returns a 302 (redirect) response that it is specifically an invitation to a Shibboleth flow, and not to an OAuth2 flow, or simply a 302 to a relocated resource? 

1b) When ECP is the designated Shibboleth authentication profile, is it expected that the client will always transmit an Accept header with "application/vnd.paos+xml" and a PAOS header for every request?

As far as I can see (which I'm thinking isn't very far) the ECP flow is predicated on the client having already identified that a particular SP is a Shibboleth protected site, or that the client is always going to transmit the HTTP headers to initiate a Shibboleth ECP flow with every request. I think both cases create challenges for client authorship: In the former case the client must maintain/manage a potentially huge list of services/resources protected by Shib. In the latter the client may be requesting one type of content (such as DAP2/4 binary data responses), but must always be prepared to intercept a Shibboleth ECP response by evaluating the value of the Content-Type header.

Am I missing something? (Almost certainly, that's why I'm asking.)


Thanks,


Nathan


= = =
Nathan Potter                        ndp at opendap.org
OPeNDAP, Inc.                        +1.541.231.3317