> Is an empty string an allowable value for TARGET in the SSO
> profiles in SAML 1.1? I can't find any guidance in the specs
> one way or the other, which suggests to me that it is allowable.
My reading was always that it was required to send something, but I guess
you could argue that sending the empty string is something. The language
around it was one of those "things I thought sucked in 1.1 that I wanted to
fix in 2.0".
As a guideline, I think a 2.0 SP should always have a "default" place to go
if a response comes in with no relay state. The spec says that the IdP can
send some kind of predefined string, but I'm not sure how useful that really
is.
-- Scott
