>     Scott> For example, many Shibboleth SPs rely on, and some put a lot
>     Scott> of stock in, the ability to filter information they get based
>     Scott> on information that's in the third party metadata.
> 
> Can you give some more concrete examples to help me?

We put information into the metadata that describes the domains that the IdP
is allowed to speak for. The domains are used in some attribute values to
qualify user identifiers or roles/affiliations and the SP can filter them
based on the metadata. This is what prevents Ohio State from claiming
somebody is a faculty member at Michigan (aside from just trusting Ohio
State not to).

It is a reasonable position to take that the effort required to enforce that
via a third party is dwarfed by the costs of injecting that third party into
the conversation (certainly that's the position the OpenID/OAuth philosophy
takes). But so far, at least, losing that ability by allowing metadata to be
self-asserted and just using PKI for trust (or maybe something else, as in
Moonshot) hasn't been pursued.

>     Scott> Another
>     Scott> example is the (admittedly US-centric) demand for LOA
>     Scott> certifications in metadata.
> 
> You basically would not get this with ASM unless AAA picks it up.

At least as you're scoping it, no. The original description of it that I was
working off of was not a replacement for metadata, but for public keys in
metadata.

> I'm honestly not sure how RADIUS requires more technical buy-in than SAML.

Central IT commitment vs. distributed IT capability. The usual debate.
 
> However at one level it doesn't matter.  My position is that we
> need to pick one base infrastructure and build everything on that. We
> seem to have picked AAA. I'm not making any claim about whether AAA or
> some other choice (including SAML) maximizes deployment in this
> discussion.  I'm claiming though that having picked our base
> infrastructure, we need to make it work with that.

I guess I think that that's desirable but not the only successful outcome.
Integrating infrastructures is a useful deliverable to me, if the
integration is clean, or even better if it improves the manageability of
either or both.

-- Scott