A note about mod_shib2 and mod_http2

[Jacob Lundberg]

Hi Scott,

What we change most often is attribute mappings.  Yes, I agree, those
who wrote the Shibboleth software :) did not foresee some of the ways we
are using it.  I don't mean to start an argument here about whether we
"should" use the software in unintended ways.  I think that would be
counterproductive.

We have been using Shibboleth for a while now and have actually given
some consideration to how we can maintain security while dealing with
many different IdPs with different degrees of competency.  Yes, the
first thing we do is tell them to use InCommon.  No, sadly, this seldom
gets them to join.  We really, really appreciate it when a new customer
is an InCommon member.

We have a working system which does a great job of what we need it to
do.  I'm sure there are some refinements we could make (and thank you
for the suggestions; we will review and see where we can improve).
However, we enabled HTTP/2 and much to our surprise our system wasn't
really working anymore.  Personally I consider that a bug somewhere.  I
just wanted to let others on this list (many of whom are our customers)
know about it.

Thanks,
-Jacob

-- 

Jacob Lundberg
AVP, IT Architecture
503.290.0100 (voice)
503.973.5252 (fax)