RE: [security-services] Assertion level Subject

["Conor P. Cahill" <concahill@aol.com>]

Scott Cantor wrote on 10/19/2003, 2:22 PM:
 >
 > One small note is that we would just need to phrase this carefully to
 > address the fact that not all statements have subjects. The only gray
 > area
 > would be a statement that had an optional subject, but we currently don't
 > have such a thing. If we did, I'm not sure it would be workable in that
 > case.

If there is was an optional subject for a statement AND the assertion 
was to be generrated with no subject for that statement the assertion 
could be generated with statement level subjects and no assertion level 
subjects.  In other words, "don't use an assertion level subject if you 
want a statement with an optional subject to have no subject".

There is a similar issue in defining what happens if both a statement 
and assertion level Subject were specified.  My suggestion is that the 
statement level subject would overide the assertion level subject and if 
both were desired in the statement, the statement would have to include 
both.

Another solution for the optional subject would be to have a special URI 
for the <Format> sub-element to represent a "NULL" subject (along the 
lines of a "this page intentionally blank" statement).

Conor