Compatibility Clarification

["Beach, Michael C" <michael.c.beach@boeing.com>]

The Boeing Company is currently running a SAML 1.0 production
implementation.  We have some 1.0 federations that have been in
production for a couple of years.  We are now adding several more both
inbound and outbound federations.  Our new "partners" obviously all want
to deploy 1.1 conformant solutions (some leveraging open source) and
there is confusion about the interoperability of our 1.0 implementation
with their 1.1 implementations.

I extracted the following from the SSTC FAQ:
"In general, minor revisions of SAML can be expected to be backwards
compatible. This version is very slightly incompatible with SAML v1.0 in
the area of XML Signature in order to take advantage of new knowledge
about XML Signature processing."

Seems to me "slightly incompatible" is similar to a "little pregnant"?
Today we are using only SSO browser POST profile, although we have had
discussions about extending that to include the artifact profile as
well.

In general I perceive inter-version compatibility to be a product issue,
not a standards issue.  This will be particularly true as we move to
SAML 2.0.  I know 1.x and 2.0 are not compatible and it is not
reasonable to expect we will all move from 1.x to 2.0 using the "big
bang" approach - so we will require products that can support
configuring a mix and match of SAML versions.

Interpretation of the FAQ statement and comments on the version 1.x
interoperability issues is most appreciated.

Thanks,
Mike Beach
The Boeing Company