> What about the case of, say, an Attribute query over SOAP? An Attribute
> Authority will respond with an assertion saying that "the entity with
> identifier X has the following associated attributes".
>
> I don't imagine that subject confirmation would be included, because the
> referenced entity isn't part of the exchange. So, the default
> interpretation of that assertion should definitely not be "bearer".
Right, that's my use case today.
> I'd like to see text in core, section 2.4.1 "Element <Subject>", state
> that the absence of any SubjectConfirmation elements MUST be interpreted
> as having no correlation to any presenter of the assertion. Leaving it
> up in the air seems very dangerous to me.
I'm happy saying it's just "unspecified", as Ron said...the authority is
making no statement about subject confirmation whatsoever.
-- Scott
