saml-dev message

Subject: RE: [saml-dev] Question about ConfirmationMethod in SSO

From: "Kavsan, Bronislav" <bkavsan@rsasecurity.com>
To: 'Adam Theo' <theo@theoretic.com>, Scott Cantor <cantor.2@osu.edu>
Date: Mon, 11 Nov 2002 09:09:29 -0500

>In what instances are the <ConfirmationMethod> and 
><SubjectConfirmationData> used? 

SAML Assertion alone does not provide its proof-of-binding to the Subject,
which makes its vulnerable to replay attacks by someone who gets hold of it.

Complimenting SAML Assertion with challenging Subject with the
proof-of-possession of some secret (symmetrical or asymmetrical) solves this
problem - that's how <ConfirmationMethod> and <SubjectConfirmationData> can
be used.