CAS / attribute filtering

[Rory Larson]

> Please don't hijack old threads, it messes with the archive.

Very sorry about that.  That was a dumb accident, certainly not intentional.


> I believe that's essentially true, but in CAS the "identity" of the system is just the location, and there's no authentication (here, and certainly generally) of the request for the data.
>
> SAML encrypts the data over the front channel as long as there's a key and authenticates the back channel with a key, so the idea of "controlling release" has a cryptographic basis. We consider that a significant difference. Needless to say, the world largely disagrees if OIDC is any evidence.

So if we use attribute filtering with CAS, we have some risk of handing out a restricted attribute to the wrong party, because we only know the machine's location, but the communication among principal, IdP and SP is not encrypted?  If the relying party for the attribute release is specified in the Shibboleth/CAS IdP configuration, would that mean that another machine was spoofing its location with a man-in-the-middle attack or something?

Anyway, thanks for the response.  It sounds like it might not be ideal to release restricted attributes in a CAS setting, even if it is possible to do.

Best,
Rory