RE: [saml-dev] more than one Assertion query per request?

["Scott Cantor" <cantor.2@osu.edu>]

> We are in a process to evaluate SAML as part of our security 
> infrastructure. We would like to send out two or more 
> Assertion queries in one SAML request by SOAP.  However the 
> SOAP binding restricts the number of SAML request per message 
> to be no more than one. (saml-bindings-2.0-os.pdf 3.2.2.1).  
> Could anybody explain to me the reason for this restriction?

Boxcarring would be a feature that could be added to other transport
bindings, but was not added to that one. Mainly because nobody asked, I
suppose.

Note that SOAP itself limits the number of child elements in the body. That
doesn't really allow for boxcarring when SOAP is used as a transport
protocol, as in this case. If we were using it as an application protocol,
then the content of the SAML messages would be in the body and the
attributes in the top element would be replaced by SOAP header blocks.

-- Scott