RE: [saml-dev] Artifact Format and EndpointIndex in 2.0

["Scott Cantor" <cantor.2@osu.edu>]

> My understanding is that a SAML2 artifact is 44 bytes in 
> length and constructed as such:
> 
> Bytes 1 & 2 contain the type code.
> Bytes 2 & 3 contain the endpoint index.
> Bytes 4-24 contain the SourceID
> Bytes 25-44 contain the Message Handle.

Well, no. A type 0x0004 artifact is defined to be that. But SAML 2.0 does
not specify that all artifacts have to follow that pattern. It only requires
that the first 4 bytes be the type code and index.

That's why the type 4 definition references the RemainingArtifact construct
in the grammar to explain that the SourceID and Message Handle are a
construct of this artifact type, not of SAML artifacts in general.

> Is this correct?  If not, can someone kindly correct my 
> misunderstanding?  If it is correct, I think a few minor 
> changes to sections 3.6.4 and 3.6.4.1 could clarify it- 
> specifically my confusion comes from the fact that 3.6.4.1 
> only makes slight mention of the EndpointIndex and leaves it 
> out of the type definition. 

It could be a little clearer, I guess, but if you combine the grammars, it's
correct as it stands.

-- Scott