use of JWT and / or STS with Shibboleth IDP?

[Klingenstein, Nate]

Nate - you said you had reservations about JWT.  Can you share your thinking?  It can be out of band if you'd rather.

This is not deeply uninformed, but I've gone down in writing with worse.

Things I don't like:

A)  3-character fields in the tokens themselves
B)  Base 64 encoding with a special character delimiter(the period . ) and fixed "A.B.C" without any indication about what A, B, or C is, or any way to change it

https://scotch.io/tutorials/the-anatomy-of-a-json-web-token

C)  If you're using OAuth, why not just use the built-in bearer tokens?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161006/331812b5/attachment.html>