RE: [security-services] sstc-bindings-extensions-02

[Scott Cantor <cantor.2@osu.edu>]

> This is admittedly a minor point and I could be swayed to go in either
> direction. However, in general there may be "other" names and values in the
> URL searchpart and the motivation here was to help avoid name clashes. I
> guess forbidding use of other parameters is not unreasonable either.

Either way works. I was just saying that there don't *need* to be any other names and values in the URL at this point, because the
flow is not extensible (you'll recall this was placed out of scope, when we were discussing my original proposal that included
extensible XML in the request format).

We could design for that extensibility now by prefixing the parameters, but I think there are better architectures for handling that
in SAML 2.0, such as a compressed XML encoding, or a pull of the request message by the source site from the destination site
(essentially an artifact approach just like the SSO profile uses).

I'm fine with the prefixes though, since the space saved is minimal.

-- Scott