InCommon metadata support

["Cantor, Scott" <>]

On 12/7/16, 6:47 PM, 
"
 on behalf of Tom Poage" 
<
 on behalf of 
>
 wrote:

> I sense there’s also not much middle ground (vs. dichotomy) to make it 
> relatively easy for Right Thing deployers to do just
> that, and to present a semi-surmountable obstacle to Wrong Thing deployers 
> to do, well, just that.

I think a non-commercial trust path for the TLS layer does exactly that, as 
best it can be done.

Those verifying signatures can frankly ignore the TLS part if they like and 
they'd still be better off than using http alone. Those not verifying 
signatures either do nothing (which they'll do regardless) or just choose to 
trust the cert, it's not that hard.

I don't think it's a burden to install a CA. On Windows it's a double click. 
If you claim as a vendor that it's against your security policy, that's 
laughable when none of the CAs you already trust have any business certifying 
SAML metadata.

-- Scott