>> Scenario: App to App (no intermediary Browser)
> There's really no profile for that scenario in SAML proper,
> so asking how it should work is sort of begging the question.
Let me see if I understand correctly:
1. Two applications directly exchanging SAML documents is not legal?
2. The only legal interaction patterns are those described in the
profiles specification?
3. The semantics of SAML when used in interaction patterns not
described in the profiles specification is undefined?
Is that what is being stated? /Roger
