Re: [saml-dev] Front-channel AttributeQuery Profile

[Tom Scavo <trscavo@gmail.com>]

On Wed, Nov 11, 2009 at 6:15 PM, Scott Cantor <cantor.2@osu.edu> wrote:
> Tom Scavo wrote on 2009-11-11:
>> As far as I understand his comment, Andreas is correct. S1 can have
>> any NameID whatsoever, as long as it has every NameID that S2 has.
>
> There's only one NameID in the Subject, so I'm not sure what case you're
> thinking of. He was suggesting that a request would have no NameID and the
> assertion would have one.

The definition of "strongly matches" in Core allows that.

> That won't fly (at least in terms of the letter of the spec).

I'm not sure what part of the spec you're referring to. Unless I'm
missing something, there's nothing in Core that requires a NameID, so
the situation above is not precluded.

Tom