RE: [security-services] FW: [saml-dev] Constrained delegation

["Cahill, Conor P" <conor.p.cahill@intel.com>]

> These are good points; maybe the issue is more about 
> capturing or recommending certain patterns of use vs. 
> developing a new profile.
> 
> But before we discuss solutions, here is a question:-:
> 
> Is it important for SAML issuers and relying parties to 
> distinguish between:

If I put X in the nameID in the subject confirmation am I not
identifying that server X is actiong for Joe?

If I don't put such a nameID, then shouldn't it be Joe
who is doing the acting (or at least something acting
as Joe as Joe probably isn't the computer application
that is proving the HoK)?

Conor