RE: [security-services] Retracting earlier SubjectRef suggestion

> From: Scott Cantor [mailto:] 
>...
> Well, assuming for the moment we're not talking about 
> actually factoring
> Subject out, my assumption is that SubjectStatement carries 
> an optional
> subject and has the semantic that such a statement requires either an
> in-band element or the assertion-level element be present. 
> Thus my point
> that it's no longer possible to assume SAML "validity" from 
> schema validity.
> I see no way around that even if we did factor Subject out, 
> since it would
> be optional either way. Without co-constraints, not much we 
> can do about
> that.

In fact, I *am* advocating completely removing SubjectStatement, and having Subject elements *only* at the Assertion level.

> StatementType could be left for others to derive truly Subject-less
> statements from.

As Eve pointed out, people whose Path Leads To Madness can still derive their own sort of SubjectStatement from our existing extensible Statement.

 - irving (i configured *@&^#*% outlook to line-wrap my text messages, but it isn't working) -