RE: [security-services] Rob's errata: Conf 2a

["Scott Cantor" <cantor.2@osu.edu>]

> So, to be conformant, is an implementation required to send/produce
> artifacts via both POST and GET?  Or just to accept them via either
> method? 

Both. The binding is not specific to POST or GET, it requires both as a
method to transmit or receive an artifact. This was copied from ID-FF,
although nobody seemed to know that it was there. The purpose is to allow
GET vs. POST to be decided as a deployment issue independent of the
deployment decision of whether to use artifact or not. The only reason
Redirect and POST are separate bindings is that they're such different
encodings.

-- Scott