Note, I'm not objecting to the text, much like in the other case, just
suggesting it may not belong here.
This seems like a good errata for core, more than a specific addition to
this profile. I agree that the current text doesn't read all that well.
It
implies that the IdP has to return an error, but it doesn't come out and
say
it, so I think we should clean that up.
That's fine.
I will add a PE to my backlog.
In the case of HoK Web Browser SSO, the problem is likely associated
with the X.509 certificate obtained from TLS client auth (so the
RequestUnsupported status code is relevant, I think).
In some cases, sure, but I don't think we need to require it. As a matter of
interop, there aren't many cases where mandating a second level status is
worth bothering with.
There's not much we can do about this in the HoK Web Browser SSO
Profile except to perhaps RECOMMEND to the client to use a DER-encoded
certificate. I doubt that recommendation is gonna make much
difference, however.
Based on the feedback I'm getting, it pretty much makes no difference. The
problem is that if people get non-DER certs, they're stuck with them. That's
kind of the problem here.
-- Scott
14 messages in org.oasis-open.lists.security-servicesRE: [security-services] comments re s...