That makes total sense, Conor. Your words could be considered errata, I think.
Tom
On Feb 11, 2008 4:20 PM, Cahill, Conor P <> wrote:
> Yes, a cookie could be considered
> some form of authentication. However, if the IdP says in the AC that
> the
> user presented username/password, then the AuthnInstant has to be when
> that
> took place, not when some session cookie was presented to the IdP.
>
> So, yes, if I have an AuthnContext that says "Got a cookie", then the
> AuthnInstant can match the IssueInstant.
>
> Conor
