Re: [saml-dev] AttributeQuery : why SOAP binding ?

[Andreas Åkre Solberg <andreas.solberg@uninett.no>]

On 4. nov.2008, at 14:37, Tom Scavo wrote:

>>
>> Is my use case not compatible with SAML2 spec ?
>
> The HTTP bindings in SAML are not general purpose HTTP bindings.  They
> were written with SAML Web Browser SSO in mind.  If you want a
> lightweight HTTP binding, you might want to look at OAuth.


By combining SAML 2.0 SOAP AttributeQueries with OAuth you get more or  
less the same as doing attributequeries front-channel, but with a lot  
of unneccessary complexity.

I'm about to setup a SAML Attribute authority very soon, and I'll see  
how it works with AttributeQueries over HTTP-POST. Main reason to do  
this front-channel is how simple it is to combine it with consent.

Combining OAuth and Attributequery-s is not specified in detail either.

You may also consider looking at @Consent in the response.

-- 
Andreas Åkre Solberg
=andreas
http://rnd.feide.no

smime.p7s