I'd like to expose a resource to both authenticated and unauthenticated users at the same time. It is called "passive protection" or "lazy session mode" in Shibboleth wolrd. What about PicketLink? Is it possible to achieve such a behaviour with PicketLink SP configuration?
