RE: [security-services] SubjectLocality/Address & SubjectConfirmationData/Address

> Is there a difference between the purpose and/or usage of the two?

Yes.

> The semantics seem to be that SubjectLocality is the IP address from
> which the subject authenticated to the IdP, and SubjectConfirmationData
> the address from which the Subject can present the Assertion to the RP.

Yes. Two different things.

> Presumably they'd be the same? Unless the Assertion is long-lived?

Depends on the use case. In SSO they would be the same.

-- Scott