RE: [security-services] Proposed clean up on subject text

["Scott Cantor" <cantor.2@osu.edu>]

> What about the case of, say, an Attribute query over SOAP?  An Attribute
> Authority will respond with an assertion saying that "the entity with
> identifier X has the following associated attributes".  
> 
> I don't imagine that subject confirmation would be included, because the
> referenced entity isn't part of the exchange.  So, the default
> interpretation of that assertion should definitely not be "bearer".  

Right, that's my use case today.

> I'd like to see text in core, section 2.4.1 "Element <Subject>", state
> that the absence of any SubjectConfirmation elements MUST be interpreted
> as having no correlation to any presenter of the assertion.  Leaving it
> up in the air seems very dangerous to me.

I'm happy saying it's just "unspecified", as Ron said...the authority is
making no statement about subject confirmation whatsoever.

-- Scott