[security-services] ECP and PAOS

[Adam Dong <adam.dong@Sun.COM>]

Hi, Robert, Scott, and others familiar with the topic,

In liberty PAOS spec, the examples (at the end of section 8)
imply that Correlation Header (from liberty soap binding spec)
to be included as a SOAP header (in addition to PAOS request
header) in both PAOS request and response messages.

In SAML2 profile spec ECP-related sections 4.2.4.3 and
4.2.4.5, the examples do not include the Correlation header.

So the question is if I'm implementing ECP, SP and IDP support
for ECP, do I include this correlation header or not ?

One aditional question, in SAML2 binding doc, section 3.3,
which talks about PAOS Binding also, there is a urn defined:
    urn:oasis:names:tc:SAML:2.0:bindings:PAOS
I don't see the use of it since the ECP examples in SAML2
profile spec uses liberty urn:
    urn:liberty:paos:2003-08

Shouldn't we have just one of these two (maybe keeping the
liberty one) ?


Thanks,
Adam