The portion of the Profile spec you refer to is
talking about the Browser SSO profile -- in that profile of SAML you MUST
NOT use an HTTP-Redirect (you can, of course, use an Artifact via HTTP-Redirect
to represent the response). That doesn't mean there aren't other profiles
of SAML that could use the HTTP-Redirect for a response
message.
In fact, the example in the Bindings is of an SLO profile
message.
Conor
From: Costello, Roger L.
[mailto:]
Sent: Thursday, May 18, 2006 11:57
AM
To:
Subject: [saml-dev]
Using HTTP Redirect to send a Response? Profiles spec says no. Bindings spec
says yes. Which is correct?
Hi
Folks,
In section 4.1.2, bullet 5 of the
Profiles specification it says: “The HTTP Redirect binding MUST NOT be
used [for sending a Response to a Service Provider], as the response will
typically exceed the URL length permitted by most user
agents”.
In the Bindings specification, in
3.4.8 it shows an example of using HTTP Redirect to send a Response to a
Service Provider.
So, the Profiles spec says that
HTTP Redirect must not be used, whereas the Bindings spec says that HTTP
Redirect can be used. Which is correct?
/Roger
