RE: [security-services] comments: sstc-saml-protocol-ext-thirdparty-cd-01

["Scott Cantor" <cantor.2@osu.edu>]

I'm uploading new drafts of all the documents I had in public review later,
but a few responses to these comments inline...

> Document identifier: sstc-saml-protocol-ext-thirdparty-cd-01
> 
> Errata:
> 
> - [line 134] s/SAML/SAML:2.0/

That's incorrect. 2.0 in a namespace means the namespace was introduced in
SAML 2.0. This one wasn't, therefore there is no version in the namespace.
It does not mean SAML version.

> Comments/Suggestions:
> 
> - Does this profile need Required Information?

Yes, the document got muddled back when it was presented as a generic
protocol extension document, I'll add now.

> - [lines 79--81] Does line 3317 of SAMLCore apply if no Format
> attribute is provided?  If so, perhaps this requires some
> clarification in the current profile.

Perhaps, but that has nothing to do with this document.

> - [lines 114--117] Append this sentence: In particular, the use of
> this extension in conjunction with the SAML SOAP Binding [SAML2Bind]
> is undefined.
> 
> - [line 128] The syntax of this attribute should agree with the syntax
> used in the X.509 Attribute Sharing profile, that is, both profiles
> should use the same syntax, either 'supportsRespondTo' or
> 'hasRespondToSupport'.  It doesn't matter which, but the two should be
> consistent.

It was actually supposed to be "hasSupport" because once it was by itself in
the separate document, the XML namespace alone tells you what's being
supported. In the interest of not sending this back to public review, I'm
leaving it alone, and that should trump any other considerations, including
consistency.

-- Scott