use of JWT and / or STS with Shibboleth IDP?

[Cantor, Scott]

> Based on their request, it feels a lot like they're asking for us to provide a
> security token service, or for for the IDP to produce JWT.

Yes, and no, we don't. We have always supported specific, interoperable profiles so we know what to put into the assertions. If there's a spec, I can certainly advise on how to create a web flow to produce something, and we have fairly reusable implementation code, though it's not a stable API. But without a spec, there's nothing to implement to.

-- Scott