RE: [security-services] Potential Erratum --NameIDMappingResponse schema

["Ari Kermaier" <ari.kermaier@oracle.com>]

Yes, I'm sure everyone will implement so as to omit the NameID element in an error case, and so everybody will interoperate and nobody will conform. :-)

But still, it would be nice for validating implementations to not have to introduce hacks to work around this issue. I guess it's a pretty low priority erratum, though.

::Ari


> -----Original Message-----
> From: Scott Cantor [mailto:cantor.2@osu.edu]
> Sent: Thursday, April 26, 2007 12:03 PM
> To: 'Ari Kermaier'; 'SSTC (E-mail)'
> Subject: RE: [security-services] Potential Erratum --
> NameIDMappingResponse schema
> 
> 
> > What is the response supposed to look like if an error 
> Status is being
> > returned? I would assume that the NameID/EncryptedID would 
> have to be
> > omitted, but the schema doesn't allow it.
> 
> Yes, the choice should be minOccurs="0".
> 
> One could argue that a validating implementation will throw 
> an error in the case where none is included, and the worst 
> outcome from that is a validation error instead of reporting 
> the server's error.
> 
> Since servers in production never return useful errors anyway...
> 
> Ok, cop out, but still...
> 
> -- Scott
> 
> 
> 
>