Query on an optional(?) element in SAMLResponse

[bhaskar jain <bhaskar.jain2002@gmail.com>]

Hello,

  We  had a long discussion internally and decided we'll send AuthnContextClassRef optionally in our SAMLResponse. 

  We'll be  a SAML 2.0 IdP supporting only web-browser SSO (supporting HTTP-Redirect at our end and post binding for SP).

  My reading of Oasis core tells me that AuthnContextClassRef is optional, Is this correct?

<AuthnStatement>
 -----
 <AuthnInstant> required
    <SessionIndex> optional
   <SessionNotOnOrAfter> optional
   <SubjectLocality optional 

      <adddress> optional  

      <DNSName> optional
  <AuthnContext> required
    <AuthnContextClassRef> optional
    <AuthnContextDecl> optional
    <AuthenticatingAuthority> zero or more

 

But have been advised by actual implementors that we should send it always. (http://lists.labs.libre-entreprise.org/pipermail/lasso-devel/2009-September/002456.html - 

Thanks to Benjamin of Lasso for answering all my questions)

What are your comments?

Thanks in advance.

--Bhaskar.