RE: [security-services] A browser/POST question...

[Scott Cantor <cantor.2@osu.edu>]

> My problem is that this is a change in semantics. Instead of 
> ALL assertions being transferred as "bearer" assertions only 
> the SSO assertions now have these properties. 
> 
> Both the artifact and FORM/Post profile permit multiple 
> assertions to be transferred. In each case, the 
> <ConfirmationMethod> is to be set appropriately either to 
> "artifact" or to "bearer". 

If that's true (and it does match what the text says), then we should at least edit the text to properly clarify that *every*
SubjectStatement (or derived element thereof) is to include that method.

Saying "the assertion contains" is something that shows up all over and just creates confusion in the same way that having multiple
assertions in responses can create confusion if the language just implies one.

-- Scott