shib / saml protection for IoT

[Cantor, Scott]

> I've seen that with streaming apps.. but that associates devices with specific
> users (their owners?).  We're looking for something to authenticate devices
> that are location based (rather than user based).

But what is the IdP actually doing with them? It doesn't necessarily care whether the "user identity" it's handling is a user or a device, but in most IDM systems today, devices don't get represented, so there's no identity really express. I realize that's changing, perhaps, but from the IdP point of view, that wouldn't really matter to it, you just express whatever you want to. Perhaps the real problem is more that we can barely agree on good ways to identify people, let alone start identifying things.

-- Scott