Hacker News Reader

...with LDAP and ideally older Kerberos backends.

If that's what I need I'd rather use WS-Federation or SAML. Both have been around for longer, and I consequently have a lot more faith in them. Sure, they're XML-based, but that's quite ok for what I'm getting.

View on HN

With all due respect you probably do not work in an institution where you have to rely on SAML for day-to-day operations (I work in a uni, so Shibboleth). If you did, you would realize why SAML is lauded as a great solution, but in reality can be very fragile and needs to be rolled out all or nothing. I have been part of a multi-year piecemeal deployment and it has rough edges.

I have, and know exactly what the issues are. It's why (if given the choice) I prefer WS-Fed and Active Directory. ADFS 2 for .Net is phenomenally good.

> in reality can be very fragile and needs to be rolled out all or nothing.

What makes you say that? That certainly isn't my experience with Shibboleth.

We deployed our IDP in 2006-07 (I think) and slowly migrated services to it.

Reply on news.ycombinator.com