RE: [security-services-comment] comments re Sstc-saml-metadata-algsupport-csprd02

["Scott Cantor" <cantor.2@osu.edu>]

> These comments pertain to Sstc-saml-metadata-algsupport-csprd02 (PDF).

I believe formally speaking that comments are limited to the content that's
changed since CSD-01, which is quite limited to some examples and a small
schema change. Mary added that information in a follow-up to the PR
announcement, usually it's part of the PR package.

I think all that means is that we're not required as a TC to respond to
other feedback, but see below.

> - The document contains no line numbers and is therefore difficult to
> reference. This is probably enough to require an additional public
> review.

There's no such requirement, and many TCs use docbook, which doesn't have
that feature anyway. Document prep is now up to tc-admin, so it's out of the
TC's control in any case.

> - The second paragraph of section 2.4 refers to extension elements to
> be included as child elements in an <md:EntityDescriptor> element
> and/or an element whose type is based on md:RoleDescriptorType, but
> the interpretation of *multiple* such elements is deferred to section
> 2.5. Although the producer can infer its conformance requirements from
> the text in section 2.5, I think the producer's requirements should be
> explicitly stated in section 2.4.

Worth fixing, but not unless another draft is done obviously.

> - In the schema listed in section 2.4, no extended XML attributes are
> allowed. Is this intentional?

Yes, I followed the conventions used by XML Signature and Encryption for
algorithm "parameters", which are always in element form. The relevant
elements there don't allow for attribute extension, so any such "parameters"
would show up here as similar content.

In practice, I doubt we'll see much in the way of that, but the schema was
left open to allow for it.

-- Scott