> I am struggling with how to specify how a SAML assertion
> would be carried to the relying-party on the RESTful request.
If the RP can somehow obtain a URI pointing to an assertion (which may be feasible, depending on the application's workflow), you could consider the use of the SAML URI Binding (section 3.7 of SAML Bindings). This is a pull operation, rather than a push.
HTH, josh.
JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG
