Re: [security-services] Authentication Methods - Proposed changestocore-29

[Jeff Hodges <Jeff.Hodges@sun.com>]

Phill wrote:
>
> Proposed complete text:
>  
> Subject Confirmation Methods are defined in the SAML Profile or Profiles 
> in which they are used [SAMLBind]. Additional methods may be added by
> defining new profiles or by private agreement.
>
> [..snip..]

I nominally agree with the wording in the above sentences (see below for a
suggested rewording)

However, this is what is actually in core-30 (lines 722-726)..

> URI references identifying SAML-defined confirmation methods are 
> currently defined with the SAML profiles in [SAMLBind]. Additional 
> SAML confirmation methods may be defined in future OASIS-approved 
> SAML profile specifications.


Which I don't agree with. Future SAML profile specifications may be simply
"registered" (section 2 of bindings-model-13), or may be OASIS standards-track
(and thus also "registered"), or may be by private agreement. 

Here's proposed wording for lines 722-726..

  URI references identifying current SAML-defined confirmation methods 
  are specified with the SAML profiles in [SAMLBind]. Additional methods 
  may be defined by registering new profiles or by private agreement.


JeffH