use of JWT and / or STS with Shibboleth IDP?

[Klingenstein, Nate]

> What built-in tokens are you referring to? AFAIK, they're opaque to OAuth when it describes itself in generic terms.

"Not completely uninformed" isn't "informed".

Just plain "Bearer".  Built-in was the wrong term.  Apparently there was supposed to be/is a registry of types.

Trying again: I just use RFC 6751 if I want a barebones implementation of RFC 6749.  If I wanted more, I would use SAML tokens because the fields are more than 3 bytes long and it doesn't rely on an arbitrary delimiter and fixed A.B.C convention.

It's not that I think JWT is bad or good or anything.  It just hits that sweet empty spot in between use cases without encompassing any of them for me.

This is the same marginally informed answer I gave others.  If a developer wants to use it with a compelling reason, I'm fine with it.  I just haven't heard that reason yet.