RE: [security-services] profiles potential errata?

> This description is confusing in that it sounds like it could 
> be two different values; an error response location or an 
> AssertionConsumerServiceURL.  This is clearly not what was 
> meant. Or am I missing something?

It's both, at the same time.

> First, isn't it simply where the ECP should send the 
> "response", not an "error response"? Isn't it always just the 
> SP's AssertionConsumerServiceURL?

Yes. But unlike a browser, the ECP can directly respond if it can't handle
the request, and it has to know where to send the error.

> Finally, in the example on page 29 of Profiles, Line 964 uses a
> ResponseConsumerURL of 
> http://identity-service.example.com/abc.  However, since this 
> value must be an AssertionConsumerService at the SP, I recommend
> changing it to 
> https://ServiceProvider.example.com/AssertionConsumerService 
> (for consistency with other examples in the section). 

Could swear somebody else already mentioned that, isn't it in the errata?

-- Scott