It’s easier to say what it isn’t!

• It ISN’T about authentication management!

• • (Authentication=The act of verifying that an electronic identity is being employed by the entity, person or process to whom it was issued.)
  • Shibboleth thinks that institutions should run their own authentication systems and others should trust those processes

• It ISN’T about authorisation management!

• • (Authorisation=Associating rights or capabilities with a subject/person)
  • Other information about individuals (groups, status etc.) should be managed by the institution too!