[security-services-comment] profiles and bindings.

Deer OASIS:

I am a student and was recently doing some reading on SAML. I have read the
documentation but ideas related to profiles and bindings still are not
entirely clear to me. I understand that the binding is the means in which
the request/response assertion is transported but it seems to me that the
profile does somewhat the same thing. As defined, the profile states how a
SAML assertion is inserted or extracted from a message or protocol (that
makes sense). My confusion comes, however, because it seems in the case of
the SSO profile (through a Web browser) that first of all we are not using
the SOAP binding and that this actually defines another means for an
assertion to be transported (which would seem to indicate an additionally
binding via solely HTTP). Any info would be greatly appreciated.

Sincerely,

Kenny Yarmosh