RE: schema 16 comments: query by artifact, another argument

Title: schema 16 comments: query by artifact.

Another argument in support of QueryKey 
element:

 

Authentication query in schema 16 includes 
saml:ConfirmationMethod that is optionaly specified 

by the 
relying party.

 

If we 
query authn assertion by artifact in the way it is currently defined 
we can not provide it.

 

ie 
Destination site using 'pull' browser profile will not be able to supply 
saml:ConfirmationMethod, 

although it may wish to do so.

 

Using 
QueryKey element we can issue complete authn query.

 

Simon

  
-----Original Message-----
From: Simon Godik 
  [mailto:]
Sent: Wednesday, September 05, 2001 
  6:21 PM
To: ; 
  ''
Cc: 
  ''
Subject: RE: schema 16 
  comments: query by artifact.

  
Corrections (sorry)

  
 

  
<element name="QueryKey" 
  type="samlp:QueryKeyType"/>

  
 

  
<complexType 
  name="QueryKeyType">

  
    ... same as 
  below...

  
</complexType>

  
 

  
Simon Godik

  
    
-----Original Message-----
From: Simon Godik 
    [mailto:]
Sent: Wednesday, September 05, 2001 
    5:46 PM
To: ''; 
    ''
Cc: 
    ''
Subject: schema 16 
    comments: query by artifact.

    
Protocol schema 16 defines 
    samlp:AssertionArtifact to satisfy browser profile flows. 

    
In our descussions it was pointed out that 
    different types of assertions could be requested by artifact: 
    
authentication and attribute. 

    
Current request schema does not let you specify 
    what type of assertion is needed with 
query by artifact. Moreover, if attribute assertion is desired we can 
    not specify what attributes are to be returned. 

    
To address these concerns I would like to propose 
    samlp:QueryKey element that is a choice of 
a subject or an artifact. 

    
<complexType name="QueryKey"> 
    
        <choice> 
        
            <element ref="saml:Subject"/> 
    
        
            <element ref="samlp:AssertionArtifact"/> 
    
        </choice>
</complexType> 

    
To include this element in protocol schema we can 
    either 
1: redefine 
    SubjectQueryAbstractType to include QueryKey: 

    
<complexType name="SubjectQueryAbstractType" 
    abstract="true"> 
        
    <complexContent> 
    
        
            <extension base="samlp:QueryAbstractType"> 
    
        
            
            <sequence> 
    
        
            
            
            <element ref="samlp:QueryKey"/> 
    
        
            
            </sequence> 
    
        
            </extension> 
    
        <complexContent>
</complexType> 

    
2: Leave SubjectQueryAbstract type alone and 
    create parallel query structure around QueryKey. 

    
Simon Godik