Re: [security-services] Adding channel bindings to signed SAML Requests

[Josh Howlett <josh.howlett@gmail.com>]

> Am I missing something, or is this reasonable?

FWIW it sounds reasonable to me. I'd been having similar thoughts  
myself... whether one could attach a <SubjectConfirmation> to the  
protocol message, with a newly defined SC method whose  
<SubjectConfirmationData> provides the CB data as you've described.  
It's not a great fit, as SAML Subject Confirmation is explicitly  
scoped to "the correspondence of the subject of the assertion", but  
there might be some value in this re-use.

Josh.