RE: [security-services] Groups - sstc-saml-x509-authn-attrib-profile-draft-10-diff.pdf uploaded

["Scott Cantor" <cantor.2@osu.edu>]

> So SP metadata (according to this profile) is a MUST?

No, metadata is never a MUST. It's not even really a SHOULD. There are rules
to follow if you're using metadata. If you're not, you're free to do
whatever you want.

> While IdP metadata (according to this profile) is a SHOULD?

Same issue. I'm just saying that IdP metadata here is probably usable as is
in many cases (Ari has made the same point) while I agree with you that
there really is no obvious way to represent the SP side without an
extension. But since metadata can be used to exchange information and not to
automate configuration, you could easily stuff it into SPSSODescriptor and
plenty of people would get along just fine.

-- Scott