RE: [security-services] ECP

["Scott Cantor" <cantor.2@osu.edu>]

> 1. Related to conformance -- a conformant IDP must support an 
> AuthnRequest profile using the HTTP-Redirect binding based on 
> the doc (this is explicit in the conformance doc). It must 
> also however support the SOAP binding (which is implied in 
> the conformance doc based on the requirement for ECP).

Yes, that probably should have been spelled out.

> 2. In the Binding spec, line 732, related to how the ECP 
> conveys the AuthnRequest to the IDP. It says the ECP does 
> this "...using a modified form of the SAML SOAP binding with 
> the additional allowance that the identity provider may 
> exchange arbitrary HTTP messages with the ECP...."  Does the 
> phrase "modified form" correspond with the additional 
> allowance to exchange messages or is it meant to imply 
> something else in addition to being able to exchange messages?  

Just that. It's a weak attempt to justify not defining a whole new binding
just to get around the SOAP binding's usual language about it only being
SOAP in, SOAP out, one exchange.

-- Scott