[security-services] 2 questions on AuthenticationQuery

["Philpott, Robert" <rphilpott@rsasecurity.com>]

Pardon the newbie questions, but I just wanted to make sure there's not a mistake in the spec. Note that I haven't gotten through all of the docs yet, so these might be covered elsewhere.  I apologize in advance if that's the case.

 

In section 3.3.3 (line 976) of draft-sstc-core-25, an AuthenticationQuery element is defined to contain either 0 or 1 saml:ConfirmationMethod elements (since no maxOccurs is specified). 

 

Q1: The section describes what the response must be if a ConfirmationMethod is specified in the request.  But it doesn't describe what happens if it is not specified.  I concluded that the response MUST contain all authentication assertions for the subject.  Is this correct? Whether or not it's correct, it would help to describe this case in the section as well.

 

Q2: What was the rationale for limiting AuthenticationQuery's to just one ConfirmationMethod?  The semantics of a request with multiple methods could be to return just those assertions that match any of the methods, but there wouldn't have to be a match for all of the requested methods for success.  Thus, a requester could use this as a filter to limit the assertions that get returned to those that the requester wants to support.  With the current definition, I could obviously do this by making separate AuthenticationQuery requests, but that seems inefficient.

 

Thanks!

 

Rob Philpott

RSA Security Inc.

The Most Trusted Name in e-Security

Tel: 781-687-7585

Mobile: 617-510-0893

Fax: 781-687-7019

mailto:rphilpott@rsasecurity.com

 

 

============================================================================================

This e-mail, its content and any files transmitted with it are intended solely for the addressee(s) and are PRIVILEGED and

CONFIDENTIAL. Access by any other party is unauthorized without the express prior written permission of the sender. If

you have received this e-mail in error you may not copy, disclose to any third party or use the contents, attachments or

information in any way, Please delete all copies of the e-mail and the attachment(s), if any and notify the sender.

Thank You.

============================================================================================