[security-services] ISSUE: Form of a response when the request ismissing/malformed

["Eve L. Maler" <eve.maler@sun.com>]

I am assuming that the correct SAML status code to use when a request is 
badly malformed (or is simply missing from the SOAP payload) is "Sender"; 
that is, there has been an error "in the sender or in the request".

But what should the InResponseTo attribute on the response be, if the 
request didn't, say, even have an ID or any innards at all?

	Eve
--
Eve Maler                                    +1 781 442 3190
Sun Microsystems XML Technology Center   eve.maler @ sun.com