[security-services] Question on the use of <RespondWith>

Title: Question on the use of <RespondWith>

I have a question on the use of <RespondWith> in the RequestAbstractType of the protocol. How would this be used to obtain an Assertion with multiple Statements? In general, are there a use cases (maybe to be added to the binding model)  that define when multiple Statements within a single assertion would be returned to a client? Is there a use case for multiple Statements of different types within the same Assertion?

Any pointers to discussion threads on this topic would be appreciated.

For example, I would like to obtain both Authentication information and Attribute information. It appears that there is a great deal of flexibility in the spec for doing this which may lead to interoperability issues.

Here are some potential ways to do it...

1) Separate Request/Response pairs

    <Request ...>

      <RespondWith>AuthenticationStatement</RespondWith>

      <AuthenticationQuery...>  

  </Request>

  <Response ...>

      <Status>...</Status>

        <Assertion ...>

          <AuthenticationStatement ...>

      </Assertion>

  </Response>

    <Request ...>

      <RespondWith>AttributeStatement</RespondWith>

      <AttributeQuery...>       

  </Request>

  <Response ...>

      <Status>...</Status>

        <Assertion ...>

          <AttributeStatement ...>

      </Assertion>

  </Response>

2) Multiple Assertions returned in a single Request/Response

    <Request ...>

      <RespondWith>AuthenticationStatement</RespondWith>

      <RespondWith>AttributeStatement</RespondWith>

      <AuthenticationQuery...>  

  </Request>

  <Response ...>

      <Status>...</Status>

        <Assertion ...>

          <AuthenticationStatement ...>

      </Assertion>

        <Assertion ...>

          <AttributeStatement ...>

      </Assertion>

  </Response>

3)Single Assertion with multiple Statements in a single Request/Response

    <Request ...>

      <RespondWith>MultipleStatement</RespondWith> <!-- Is this how it works? -->

      <RespondWith>AuthenticationStatement</RespondWith>

      <RespondWith>AttributeStatement</RespondWith>

      <AuthenticationQuery...>  

  </Request>

  <Response ...>

      <Status>...</Status>

        <Assertion ...>

          <AuthenticationStatement ...>

          <AttributeStatement ...>

      </Assertion>

  </Response>

Thanks,

Joe

Joe Sanfilippo

Commerce One

19191 Vallco Parkway, Cupertino, CA 95014

Tel 408 517 9245; Fax 408 517 3992