RE: [saml-dev] empty assertions

["Scott Cantor" <cantor.2@osu.edu>]

> In response to an attribute query, if no attributes for the principal
> are available, it seems the IdP should return an empty response.

Well, if you consider a Status message empty...

> In SAML V2.0, does it make sense to return an empty assertion instead?
> (This is legal in SAML V2.0, right?)

That's not what the protocol is trying to permit, though.

> In general, what are the uses of an empty assertion?

Nothing I can think of, and I would tend to think it wasn't really meant to
be valid. XSD doesn't have co-constraints, so you can't say "Subject is
required unless there are no statements..." or that kind of thing.

-- Scott