RE: [security-services] AssertionConsumerServiceIndex vs. AssertionConsumerURL

["Scott Cantor" <cantor.2@osu.edu>]

> Turning to the description of AssertionConsumerServiceIndex 
> in core, the sentence "It applies only to profiles in which 
> the request issuer is different from the presenter" confuses 
> me even further. Does this mean that the Web SSO profile does 
> not use this attribute?

No, the SSO profile is one example in which the request issuer (the SP) is
different from the presenter (the browser).

Contrast this with a hypothetical profile for use by a smarter client that
is, perhaps, SOAP-aware. Such a client could itself request assertions
directly using the SOAP binding, and there's no notion of
"AssertionConsumerService" there. The client takes the assertions it gets
and uses them as desired.

I thought it worth noting this distinction, but my language for doing so was
obviously very brief and vague.

-- Scott