> This is the problem... how do I explain how to my RESTful API would
> carry the URI? I was hoping that there was a common way to do this, like
> there is with WS-Security in the SOAP world.
Using a URI is a bigger problem than that because most IdPs wouldn't
remember the assertion for you to dereference.
If you're trying to bind either a URI or a token to every message, then
OAuth is clearly the answer, modulo that I don't agree with their security
choices, and would hope that it would be deemed inadequate for health care
use cases.
If you can live with session-based security vis cookies and/or (more
preferably) client TLS, then ECP works fine for that.
-- Scott
