RE: [saml-dev] Empty Target Value Acceptable in SAML 1.1?

["Scott Cantor" <cantor.2@osu.edu>]

> Is an empty string an allowable value for TARGET in the SSO 
> profiles in SAML 1.1?  I can't find any guidance in the specs 
> one way or the other, which suggests to me that it is allowable.

My reading was always that it was required to send something, but I guess
you could argue that sending the empty string is something. The language
around it was one of those "things I thought sucked in 1.1 that I wanted to
fix in 2.0".

As a guideline, I think a 2.0 SP should always have a "default" place to go
if a response comes in with no relay state. The spec says that the IdP can
send some kind of predefined string, but I'm not sure how useful that really
is.

-- Scott