RE: [saml-dev] Using HTTP Redirect to send a Response? Profiles spec says no. Bindings spec says yes. Which is correct?

The term ‘Response’ is a
little overloaded.  

 

In profiles it is referring specifically
to a Response containing an assertion (think of it as an [Authn]Response). 
Where bindings is talking about the more generic concept of a response –
single logout response, name identifier response, etc.

 

 

 

From: Costello, Roger
L. [mailto:] 

Sent: Thursday, May 18, 2006 9:57
AM

To: 

Subject: [saml-dev] Using HTTP
Redirect to send a Response? Profiles spec says no. Bindings spec says yes.
Which is correct?

 

Hi Folks,

 

In section 4.1.2, bullet 5 of the Profiles specification it
says:  “The HTTP Redirect binding MUST NOT be used [for sending a
Response to a Service Provider], as the response will typically exceed the URL
length permitted by most user agents”.

 

In the Bindings specification, in 3.4.8 it shows an example
of using HTTP Redirect to send a Response to a Service Provider.

 

So, the Profiles spec says that HTTP Redirect must not be
used, whereas the Bindings spec says that HTTP Redirect can be used. 
Which is correct?  /Roger