client authenticated IdP metadata

Peter Schober peter.schober at univie.ac.at
Thu Apr 26 02:47:53 EDT 2018


* Jeremy Shapiro <jnshapiro at gmail.com> [2018-04-26 07:25]:
> Inadvised for security reasons or because it's hard to get working?

What purpose does it serve? Metadata shouldn't contain secrets and
shouldn't vary depending on who's asking, so should be no need to
enforce the HTTP client's identity.
-peter


More information about the users mailing list