RE: [security-services] SAMLCore errors in mandating some second-level s

security-services message

Subject: RE: [security-services] SAMLCore errors in mandating some second-level status codes

From: "Cahill, Conor P" <conor.p.cahill@intel.com>

To: "Philpott, Robert" <rphilpott@rsasecurity.com>,<security-services@lists.oasis-open.org>

Date: Wed, 29 Aug 2007 17:38:17 -0700

When I’ve been dealing with this issue in Liberty specs I’m editing, I prefer:

If none of the specified classes or declarations can be satisfied in accordance with the rules below, the responder MUST return a <Response> message with a top-level <StatusCode> value of …:Responder. If a second-level <StatusCode> is included in the <Response> message it MUST have a value of “…:NoAuthnContext”.

In other words saying you can leave off the second level status code, but if you do include one, it must be the one specified here.

Conor

“If none of the specified classes or declarations can be satisfied in accordance with the rules below, then the responder MUST return a <Response> message with a top-level <StatusCode> value of urn:oasis:names:tc:SAML:2.0:status:Responder and MAY return a second-level <StatusCode> value of urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext.”