> To meet the OASIS requirement, I think we will need to list
> three companies for each of the following line items:
>
> Requester of AuthN by means of SOAP-over-HTTP binding
> Requester of AuthZ by means of SOAP-over-HTTP binding
> Requester of Attrib by means of SOAP-over-HTTP binding
My only question regarding evaluating compliance this way is what the
obligations of a requester are with respect to understanding a Response
containing the different kinds of statements.
If I claim the latter function (sending an AttributeRequest), what must
I be able to do with the response? Need anything be said at all, given
that the requester is the RP and is free to drop it in the bit bucket?
-- Scott
