On 4. nov.2008, at 14:37, Tom Scavo wrote:
>>
>> Is my use case not compatible with SAML2 spec ?
>
> The HTTP bindings in SAML are not general purpose HTTP bindings. They
> were written with SAML Web Browser SSO in mind. If you want a
> lightweight HTTP binding, you might want to look at OAuth.
By combining SAML 2.0 SOAP AttributeQueries with OAuth you get more or
less the same as doing attributequeries front-channel, but with a lot
of unneccessary complexity.
I'm about to setup a SAML Attribute authority very soon, and I'll see
how it works with AttributeQueries over HTTP-POST. Main reason to do
this front-channel is how simple it is to combine it with consent.
Combining OAuth and Attributequery-s is not specified in detail either.
You may also consider looking at @Consent in the response.
--
Andreas 儼re Solberg
=andreas
http://rnd.feide.no
