RE: [saml-dev] architecture for artifact profile ?

[Scott Cantor <cantor.2@osu.edu>]

> If I understand well the specs, there is no need of SAML 
> query elements for basic scheme in Artifact and Post 
> profiles.

I know you use a query of some sort to fetch the assertion using the
artifact, but I can't recall if that's a Query or just a Request with
the artifact in it. I didn't implement it, so I'm not sure.

> encapsulated Assertion. So, in which case SAML queries can be 
> used ? For later use in DestinationSite, if I would like to 
> ckeck again (after a timeout) if X user is still authenticated ?

No, session-related timeouts are not part of the profile. Queries are
generally used to fetch additional assertions with attributes or request
authz decisions.

-- Scott