[saml-dev] ? re: multiple artifacts in a single BAP exchange

["Philpott, Robert" <rphilpott@rsasecurity.com>]

Hi folks,

 

I've been asked about this a couple of times - once by a SAML developer and once by a Liberty architect...

 

In the SAML Bindings and Profiles description of the Browser/Artifact Profile, it is stated in lines 467-470 and 491-494 that: "A single target description MUST be included in the <SAML searchpart> component. At least one SAML artifact MUST be included in the <SAML searchpart> component; multiple SAML artifacts MAY be included. If more than one artifact is carried within <SAML searchpart>, all the artifacts MUST have the same SourceID."

 

This description was carried forward into Liberty as well.

 

The question that folks have asked me is "what is the use case/need that would result in multiple artifacts being generated?".  Does anyone know of any products that will actually produce a BAP redirect with multiple SAMLart parameters?

 

Also, the use of the "MAY" here isn't quite clear to me.  Does it mean that vendors MAY choose to support multiple artifacts but MAY also just support a single artifact - i.e. the implementation never sends more than one and it can reject the request where more than one exists?  Or since it says that multiple artifacts MAY be included, does it infer that a conforming implementation must be able to handle all of them?

 

Thanks!

Rob Philpott
RSA Security Inc.
The Most Trusted Name in e-Security
Tel: 781-515-7115
Mobile: 617-510-0893
Fax: 781-515-7020
mailto:rphilpott@rsasecurity.com