How Shibboleth Works - Real Version

• Target must determine the user's institition before contacting the Origin (WAYF)

• Origin must authenticate the user before it can provide any attributes

• Target is not allowed to observe the authentication process