RE: Substitution Groups Reconsidered

["Hallam-Baker, Phillip" <pbaker@verisign.com>]

> I'm not talking about restricting the ability of extension schemas to 
> extend types ("final"), but rather about restricting their ability to 
> declare that extension elements can substitute themselves for 
> any SAML 
> element they like ("block").  I thought we agreed that 
> substitution in 
> extensions was bad, 

We certainly did not.

> because it could cause major confusion if 
> the extension 
> schema is not available.  

That is the reason for the introduction of the <AbstractStatement> element
as a child of <Assertion> rather than the two aspects being confused.

The general agreement was that if you don't have the extension schema you
cannot perform validation of the elements described therein, but one may
well want to have a preprocessor that can perform tasks such as
pre-validation of the assertion (check signature, trusted issuer, conditions
valid etc.) The current schema meets this goal.


> Does this take away your concern?

No.

Phillip Hallam-Baker (E-mail).vcf