> In the definition of "strongly matches" in section 3.3.4 of SAML2Core,
> is it implied that the SubjectConfirmation/@Method attributes of the
> two Subjects are equal?
@Method more or less yes, along with the other simple content, but the
actual confirmation data, nope. Quite by design, e.g. "HoK using KeyName
Foo" -> "HoK using X509Certificate"
> Without this requirement, it seems the condition is untestable.
It is, at least outside the bounds of a particular deployment. "All interop
ends at ds:KeyInfo (tm)"
-- Scott
