>First, I would like to understand more about the situation where the IdP >has neither a contract with the service provider nor with the federation >to which they both belong. That is- what are the ad hoc circumstances?
The contract with the federation doesn't generally address release of data to anybody, so it doesn't address liability of the IdP for doing so. The canonical circumstance is any collaboration across a pair of universities. If we can't figure out how to address that problem with federation, it will get addressed by Google and our users will just ignore all those regulations. -- Scott _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
