Da Capo: First contact

Title: RE: First contact

Hi Tim,

May I discuss this issue a little bit further on 
the global list (I have

not yet received bindings membership)?  You 
say the partner IDs 

should be agreed bi-laterally.  I don't think 
that will work too well.

The partner ID must be specified by the RP, 
otherwise it could

be ambigious and not be properly interpreted.  
Working with

plug-and-play, I believe that SAML ought to support 
a sign-me-up

message to exchange such critical data.  This 
32-bit data is BTW

probably not compatible with existing customer IDs which makes this

solution less 
appetizing.

 

What are the advantages with the current artifact 
over opaque bearer

objects as described 
by me?  Well, I know that my scheme does not

support pull but in what way is pull better than 
push? Push gives IMO

much better control for the AA that will find out 
errors before the user,

who in pull will have to call the AA to say an URL 
is wrong or a server

is dead.

 

Regards

Anders

  
----- Original Message ----- 

  
From: 
  Tim 
  Moses 

  
To: OASIS SAML 

  
Sent: Friday, July 27, 2001 20:21

  
Subject: RE: First contact

  

  
Anders - I think the bit that is missing for you is how the 
  SAML artifact identifies the location of the corresponding assertion.  
  One solution is proposed in the SAML Bindings draft.  However, this 
  solution is not positioned as the only possible solution.  Furthermore, 
  even this solution has not been formally accepted by the group - that 
  discussion is yet to come.  The existing solution is to agree identifiers 
  for parties on a bilateral basis.  This identifier is encoded in 32 bits 
  of the artifact and each party is configured to translate the identifier into 
  (for example) a URL.

  
Best regards.  Tim. 

  
-----Original Message----- 
From: 
  Anders Rundgren [mailto:] 
  
Sent: Friday, July 27, 2001 12:12 PM 
To: Tim Moses; OASIS SAML 
Subject: Re: First 
  contact 

  
Tim 

  
>snip 
> In my mind, a Push 
  version appears to have limited utility (that's a British phrase, 
  
>which, when translated into American, comes out something 
  like: "A Push version is brain-dead"). 

  
Interesting, if you studied the document I sent you I 
  indirectly came to the same 
conclusion of the Push 
  version.  I.e. the Pull URL seems to be completely in the air. 

  
Do *you* know where to get these? 

  
Anders