[saml-dev] ConfirmationData?

["Philpott, Robert" <rphilpott@rsasecurity.com>]

The specs aren't really clear on this... Do folks expect to receive a ConfirmationData element containing the artifact as part of the SubjectConfirmation when using the Artifact-01 method?

 

 I've seen a sample assertion that did have it and one that didn't. 

 

I assume you would want it so the relying party could (if they so desire) verify the assertion statements are associated with a particular artifact-based request.

 

Thanks,

 

Rob Philpott

RSA Security Inc.

The Most Trusted Name in e-Security

Tel: 781-515-7115

Mobile: 617-510-0893

Fax: 781-515-7020

mailto:rphilpott@rsasecurity.com