RE: [saml-dev] asynchronous response on SAML over SOAP over HTTP

[Yuji Sakata <ysakata@rd.nttdata.co.jp>]

> Keep in mind, the SOAP binding is only required when it is necessary
> retrieve Assertions out of band. This is used for example, in the
> Browser/artifact Profile.
> way this would work would be:
> 
> 1. An SAML Assertion ID would be sent in the Token Reference Header, along
> with the application data, from the application client to the application
> server.
> 
> 2. The application server, if it did not already have a copy of the
> assertion would retrieve it from the Asserting Party (e.g. Attribute
> Authority). This would be done using the SOAP Binding.
> 
> Even in this case, it is not clear the SOAP Binding, (as distinct from the
> WS-Security Profile) needs to support asynchronous messaging. It seems to me
> that once the application had received the asynchronous request and was
> ready to act upon it, it would want to retrieve the Assertion immediately.
> Therefore is seems that the application to Authority channel could remain
> synchronous even if the client to server channel is asynchronous.

I was confused with how and when to use SOAP Bindng.

my understanding is as following 
1.  SOAP Binding is used only when SAML Assertions must be retrived out 
of band, not it isn't used when they are sent as attached security 
tokens.
2. SOAP Binding is independent of the undelying protocol on which SOAP 
messages are transported.
However, because of how and when to use SOAP Binding, asynchronous SOAP 
Binding isn't required.

Thank you, and I really wish your success of  demonstration at Catalyst.

Regards,
----------------------------------------------
NTT Data Corporation 
Yuji Sakata
Tel: +81-3-3523-8081
E-Mail: ysakata@rd.nttdata.co.jp
----------------------------------------------