> I dont have a big issue with this but I do not really see
> this as errata. Basically, it does not matter what the
> <saml:ConfirmationMethod> is set to in the FORM/POST profile;
> it is never discussed in the profile. So why explicitly
> include a statement that says DONT use it?
Method or Data? Method is always bearer, of course.
In a sense, I guess that's what I was saying originally. If people were confused by the absence of a statement about Data, I was
just trying to point out that sending it didn't make any sense.
> Scott, you have the most expeience with the POST profile. Do
> you end up spending time discussing
> <saml:ConfirmationMethod>? Is clarity the real issue here?
Yes, I think it's just a matter of clarity. It's never come up, but that's because I'm the one who implemented the profile, so the
people using my code don't mess with what's happening underneath.
-- Scott
