RE: [security-services] Web SSO <AuthnRequest> conformance

> Recognizing the size restrictions for redirects (I think it's 
> around 2k for IE), since HTTP redirect is the only binding 
> required, a conformant implementation CANNOT handle authn 
> requests that are greater than 2k.

I believe POST is also required. Am I wrong?

> Was the reasoning based on 
> the chance that authn requests (which would be b64 encoded 
> and then url encoded), would not reach this size?

My assumption was we required POST to handle that case.
 
-- Scott