RE: [saml-dev] architecture for artifact profile ?

[Scott Cantor <cantor.2@osu.edu>]

>Indeed, I externalized the SAML producer from the Source site. Thus,
when
>the source site needs to create an assertion and to get the
corresponding
>artifact, it does this by requesting the external SAML producer in a
SAML
>query.
>I do not see these SAML exchanges in the Bindings/Profiles
specification.
>Would it be better (or even mandatory) to integrate the SAML Producer
in
>the Source site and to create assertions through a Java API rather than
>creating them by SAML requests ?

"Better" is in the eye of the beholder. You're correct that you're
outside the spec. It isn't mandatory to do it via a local API, you've
simply created an API that's distributed, but it's not a SAML query in
the usual sense.

-- Scott