On Fri, Aug 17, 2012 at 8:45 PM, Cantor, Scott <> wrote:
> On 8/17/12 8:20 PM, "Tom Scavo" <> wrote:
>
>>In the "Identity Provider Discovery Profile" in SAML2Prof, it's not
>>exactly clear what is returned by the DS to the SP.
>
> The default policy is that it returns an entityID in a named parameter (or
> nothing) and that's it.
I have no idea where you're getting that since the spec nothing even
remotely similar.
>> Is it reasonable
>>to suppose the entire value of the "_saml_idp" cookie is returned as
>>the value of an HTTP parameter?
>
> If you define a policy constant to mean that, pass it to the DS, and
> implement that in the DS. With the default policy, no, that would not be
> correct.
Perhaps we're talking about two different things? Here I'm asking
about the original discovery spec in SAML2Prof, not the post-2.0
profile that you and Rod wrote.
Tom
