saml-dev message

Subject: Re: [saml-dev] Seeking clarity on the SubjectConfirmation element

From: "Tom Scavo" <trscavo@gmail.com>
To: "Costello, Roger L." <costello@mitre.org>
Date: Tue, 6 Jun 2006 08:50:29 -0400

On 6/6/06, Costello, Roger L. <costello@mitre.org> wrote:
>
> Question #2: does it make sense to use the SubjectConfirmation element in a
> WebBrowserSSO profile?

In the case of SSO, the SubjectConfirmation MUST be bearer.

https://authdev.it.ohio-state.edu/twiki/bin/view/Shibboleth/SubjectConfirmation

> Suppose that the presenter has a stolen
> assertion as I describe above; the SP would be taking a big risk by not
> reauthenticating the presenter, correct?

Read the "Security and Privacy Considerations" document.

Tom

References:
- RE: [saml-dev] HTTP error response code
  - From: "Costello, Roger L." <costello@mitre.org>
- Seeking clarity on the SubjectConfirmation element
  - From: "Costello, Roger L." <costello@mitre.org>