security-services message

Subject: Re: [security-services] Minutes from SSTC Call (Tuesday 22 November 2016) ---- RE: Proposed Agenda for SSTC Telecon (Tuesday 22 November 2016)

From: "Cantor, Scott" <cantor.2@osu.edu>
To: Madalina Sultan <madalina.sultan@connectis.nl>
Date: Fri, 2 Dec 2016 14:28:43 +0000

On 12/2/16, 4:46 AM, "Madalina Sultan" <madalina.sultan@connectis.nl> wrote:

> Regarding the metadata flag that announces support, the document currently states that it is optional. So it
> doesn't enforce anything. Do you think it will be more clear if I start from a specification like: "If an Identity
> Provider supports this extension, then it MUST define the metadata flag" ?

Metadata is/was optional in SAML, unfortunately, so there's no real way to say that. A SHOULD is a possibility but I suspect whatever language has been used in previous cases like this is the best thing to use.

-- Scott

References:
- Re: [security-services] Minutes from SSTC Call (Tuesday 22 November 2016) ---- RE: Proposed Agenda for SSTC Telecon (Tuesday 22 November 2016)
  - From: Madalina Sultan <madalina.sultan@connectis.nl>