security-use message

Subject: Is this a part of SAML?

From: Anders Rundgren <anders.rundgren@telia.com>
To: S2ML-USE <security-use@lists.oasis-open.org>
Date: Thu, 05 Apr 2001 20:56:37 +0200

Hi
I am currently a "lurker" only due to lack of time.  My question is simple though:
Somebody told me that the following is supported by SAML as an alternative to
redirected URL and cookie-references to assertions.  Is this correct? I'm unable to find
any SAML-documents showing that.

<HTML>
<BODY  Onload="javascript:document.forms[0].submit ()">
<FORM  METHOD="POST"  ACTION="TARGET SERVER URL">
<INPUT TYPE="HIDDEN"  NAME="SAML " VALUE="ASSERTION IN BASE64-CODING">
</FORM>
</BODY>
</HTML>

This is BTW how VISA move transaction requests in their coming 3D Secure payment system,

It has two advantages over references: one round less and potential elimination of extra server-state
for holding assertions.  If you want you can tryout a pre-SAML solution using this on http://buyer.x-obi.com

Regards
Anders