Box.com and Shibboleth

[Cantor, Scott]

> Plus, it seems too strong to require a restart of the IdP to change the
> attributes returned from an LDAP query.

That's more in the vein of deployer preference since they can always avoid that if they want, plus I've never really seen too many people reload the resolver. Changing the resolver is a big deal and highly prone to error. You don't do that at runtime very much.

-- Scott