> What is the response supposed to look like if an error Status is being
> returned? I would assume that the NameID/EncryptedID would have to be
> omitted, but the schema doesn't allow it.
Yes, the choice should be minOccurs="0".
One could argue that a validating implementation will throw an error in the case where none is included, and the worst outcome from that is a validation error instead of reporting the server's error.
Since servers in production never return useful errors anyway...
Ok, cop out, but still...
-- Scott
