Shibboleth without Back Channel?

[Cantor, Scott]

> I greped  idp-audit.log for "SOAP", removing ECP/MicrosoftOnline.
> Is that good enough?

Yes.

> Is discontinuing the back-channel the right direction?

I was all set to until an ezproxy server that shall remain nameless derailed those plans.

Any future use of the "backchannel" as a strategic direction will be over port 443 and use message level security. I will never countenance the use of commercial TLS as a security mechanism, which makes it harder for us to use that approach than projects that have a different perspective on that.

-- Scott