later refined in Shibboleth IdP 1.3. Building on that early work, the Liberty Alliance introduced a fully expanded AuthnRequest protocol into the Liberty Identity Federation Framework. Eventually, Liberty ID-FF 1.2 was contributed to OASIS, which formed the basis for the OASIS SAML 2.0 Standard. Architecture Shibboleth is a web-based technology that implements the artifact and attribute push profiles of SAML, including both Identity Provider (IdP) and Service Provider (SP) components. Shibboleth 1.3 has its own technical overview, architectural document, and conformance document that build on top of the SAML 1.1 specifications. Shibboleth 1.3 In the canonical use case: A user first accesses a resource hosted by a web server (the service provider) that has Shibboleth content protection enabled. The SP crafts a proprietary authentication request that is passed through the browser using URL query parameters to supply the requester's SAML entityID, the assertion consumption location, and optionally the end page to return the user to. The user is redirected to either their home IdP or a WAYF (Where Are You From) service, where they select their home IdP for further redirection. The user authenticates to an access control mechanism external to Shibboleth. Shibboleth generates a SAML 1.1 authentication assertion with a temporary "handle" contained within it. This handle allows the IdP to recognize a request about a particular browser user as corresponding to the principal that authenticated earlier. The user is POSTed to the assertion consumer service of the SP. The SP consumes the assertion and issues an AttributeQuery to the IdP's attribute service for attributes about that user, which may or may not include the user's identity. The IdP sends an attribute assertion containing trusted information about the user to the SP. The SP either makes an access control decision based on the attributes or supplies information to applications to make decisions themselves. Shibboleth supports a number of variations on this base case, including portal-style flows whereby the IdP mints an unsolicited assertion to be delivered in the initial access to the SP, and lazy session initiation, which allows an application to trigger content protection through a method of its choice as required. Shibboleth 1.3 and earlier do not provide a built-in authentication mechanism, but any Web-based authentication mechanism can be used to supply user data for Shibboleth to use. Common systems for this purpose include CAS or Pubcookie. The authentication and single-sign-on features of the Java container in