RE: [security-services] A browser/POST question...

[Scott Cantor <cantor.2@osu.edu>]

> I dont have a big issue with this but I do not really see 
> this as errata. Basically, it does not matter what the 
> <saml:ConfirmationMethod> is set to in the FORM/POST profile; 
> it is never discussed in the profile. So why explicitly 
> include a statement that says DONT use it? 

Method or Data? Method is always bearer, of course.

In a sense, I guess that's what I was saying originally. If people were confused by the absence of a statement about Data, I was
just trying to point out that sending it didn't make any sense.

> Scott, you have the most expeience with the POST profile. Do 
> you end up spending time discussing 
> <saml:ConfirmationMethod>? Is clarity the real issue here?

Yes, I think it's just a matter of clarity. It's never come up, but that's because I'm the one who implemented the profile, so the
people using my code don't mess with what's happening underneath.

-- Scott