SAML token profile question

["Pim van der Eijk" <lists@sonnenglanz.net>]

 

Hello,

 

The WSS SAML token profile is defined in:

http://docs.oasis-open.org/wss-m/wss/v1.1.1/wss-SAMLTokenProfile-v1.1.1.pdf

 

Section 3.5.2 of the profiles describes the sender-vouches method of establishing the correspondence between a SOAP message and the SAML assertions added to the SOAP message according to the SAML profile of WSS: SOAP Message Security. An attesting entity uses the sender-vouches confirmation method to assert that it is acting on behalf of the subject of SAML statements attributed with a sender-vouches SubjectConfirmation element.

 

Section 3.5.2.3 provides an example SOAP message using this profile using SAML 1.1 using this subject conformation method. 

Line 823-825 in the example are:

 

<saml:ConfirmationMethod>

urn:oasis:names:tc:SAML:1.0:cm:holder-of-key

</saml:ConfirmationMethod>

 

I had expected an example with a sender vouches confirmation method:

 

<saml:ConfirmationMethod>

urn:oasis:names:tc:SAML:2.0:cm:sendervouches

</saml:ConfirmationMethod>

 

What am I missing ?

 

Pim van der Eijk