atom feed14 messages in org.oasis-open.lists.security-servicesRE: [security-services] comments re s...
FromSent OnAttachments
Tom ScavoOct 17, 2008 4:59 pm 
Nate KlingensteinNov 2, 2008 8:14 pm 
Tom ScavoNov 4, 2008 7:47 am 
Scott CantorNov 4, 2008 8:09 am 
Scott CantorNov 4, 2008 8:38 am 
Tom ScavoNov 4, 2008 8:39 am 
Tom ScavoNov 9, 2008 11:27 am 
Nate KlingensteinNov 9, 2008 9:13 pm 
Tom ScavoNov 10, 2008 5:38 am 
Mary McRaeNov 10, 2008 5:53 am 
Scott CantorNov 10, 2008 7:32 am 
Tom ScavoNov 10, 2008 10:53 am 
Scott CantorNov 10, 2008 11:48 am 
Tom ScavoNov 10, 2008 12:02 pm 
Subject:RE: [security-services] comments re sstc-saml-holder-of-key-browser-sso-draft-07
From:Scott Cantor (cant@osu.edu)
Date:Nov 4, 2008 8:38:56 am
List:org.oasis-open.lists.security-services

Well, the other alternative is to return an error, right?

For the IdP? Sure. That's the point. You just have prior knowledge about what might happen, so you can save it the trouble. If signing is a "whatever" sort of operation to the IdP, the logical thing to do is to sign if the flag is true, and do whatever the default is if it's not. If it's a major operation that the IdP doesn't normally like to do, then you'd probably consider returning an error.

I don't understand what's so vague about that.

If there were a WantAssertionsSigned attribute in AuthnRequest, would you be inclined to interpret it differently?

If it was written as a MUST (in which case that would be a bad name to use), I'd follow it, otherwise I'd do whatever I'm doing now.

-- Scott