Re: Tighten up some use cases

[Adam Dong <adam.dong@Sun.COM>]

Thomas Wisniewski wrote:

> All, here are some additional assumptions we should consider:
>
> - Each SP should support/define only a single assertion consumer 
> endpoint. I would recommend that index 0 be used for that endpoint. 
> This implies that if an AuthnRequest asks for a specific endpoint, it 
> will be the 0-indexed endpoint.
>

Agree, each SP's metadata file just  includes a single assertion 
consumer service
with the binding being HTTP-POST and the index being 0.

> - For a Response, we should decide on whether we are signing the 
> Response or the Assertion (i.e., only use one approach).
>

Lets just sign the Response, i.e., the root element.

> Tom.
>