Rob's errata: Conf 2a

"We mandate support for the HTTP Artifact binding for a Web SSO <Response>
in full and Lite versions of IDP's and SP's.  However, we do not indicate
what mechanisms (HTTP Redirect or HTTP POST) are mandated for delivery of
the artifact."

Yes, we do. The HTTP Artifact binding itself specifies that both redirect
and POST (please don't call them HTTP Redirect and HTTP POST, it conflates
them with those bindings) MUST be supported for delivery of an artifact.
Always has since I first wrote it up.

I can find the line in bindings if necessary.

-- Scott