OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: RE: [security-services] AssertionConsumerServiceIndex vs. AssertionConsumerURL

> Turning to the description of AssertionConsumerServiceIndex 
> in core, the sentence "It applies only to profiles in which 
> the request issuer is different from the presenter" confuses 
> me even further. Does this mean that the Web SSO profile does 
> not use this attribute?

No, the SSO profile is one example in which the request issuer (the SP) is
different from the presenter (the browser).

Contrast this with a hypothetical profile for use by a smarter client that
is, perhaps, SOAP-aware. Such a client could itself request assertions
directly using the SOAP binding, and there's no notion of
"AssertionConsumerService" there. The client takes the assertions it gets
and uses them as desired.

I thought it worth noting this distinction, but my language for doing so was
obviously very brief and vague.

-- Scott

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]