Re: [security-services] Minutes from SSTC Call (Tuesday 22 November 2016) ---- RE: Proposed Agenda for SSTC Telecon (Tuesday 22 November 2016)

["Cantor, Scott" <cantor.2@osu.edu>]

On 11/23/16, 8:42 AM, "security-services@lists.oasis-open.org on behalf of Madalina Sultan" <security-services@lists.oasis-open.org on behalf of madalina.sultan@connectis.nl> wrote:

> Scott/Rainer - could you please look over it and let me know if it now covers all your comments?

I think your proposed text is leaving things ambigious by using a SHOULD, particularly when the whole mechanism is advisory anyway.

I would have it say that the IdP MUST ignore the AttributeConsumingServiceIndex and any AttributeConsumingService elements in metadata if the extension is seen.

Also I think the text should say that the SP MUST NOT send both.

There will need to be a pass to clean up the language (there are a lot of grammar issues) but I am willing to do that once the updated template is used.

-- Scott