<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Shibboleth hasn't yet implemented anything I'd call dynamic metadata. It's pretty trivial to operate a Shibboleth IdP in a promiscuous mode. Most deployers don't because of user privacy requirements.</div><div><br></div><div>We clearly need to allow users to trust new RP's without administrator intervention, which is a separate issue from whether trust between IdP's and RP's exists. This was actually an initial requirement in our architecture some 7 years ago and has always been supported by the software, but we never made it feasible for users to actually do it. This was partially out of concern that paranoid users would lock themselves out of key applications, resulting in help desk calls, and partially because we suck at GUI work and have limited resources.</div><div><br></div><div>It's a key area of work right now. Here's a precursor.</div><div><br></div><div><a href="https://aai-demo.switch.ch/secure-arpviewer/">https://aai-demo.switch.ch/secure-arpviewer/</a></div><div><br></div><div>Again, I'd love to see OpenID work on adding support for trust frameworks like federations and reputation services. It's not what PAPE does, and ORMS is moving very gradually.</div><div><br></div><div>Take care,</div><div>Nate.</div><br><div><div>On 19 Oct 2008, at 16:36, Shane B Weeden wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><tt><font size="2">Sure, there are dynamic extensions to SAML like those defined by Shibboleth for dynamic metadata sharing, but out-of-the-box nothing I've been exposed to thus far quite matches the simplicity of the OpenID model.</font></tt><span class="Apple-converted-space"> </span><br></span></blockquote></div><br></body></html>