Re: [security-services] Groups - sstc-saml-holder-of-key-browser-sso-draft-09

Tom,

Yeah, I agree.  I've uploaded a new edition of -09 that reflects this (and captures Scott's response to you, which as editor I missed), to avoid going through another revision cycle just for that.

http://www.oasis-open.org/apps/org/workgroup/security/download.php/30012/sstc-saml-holder-of-key-browser-sso-draft-09.pdf

http://www.oasis-open.org/apps/org/workgroup/security/download.php/30013/sstc-saml-holder-of-key-browser-sso-draft-09.odt

Thanks for putting in a little overtime,

Nate.

On 12 Nov 2008, at 01:46, Tom Scavo wrote:

I don't think there's any doubt about that.  If a <saml:Subject> is
 
included in the request, "strongly matches" pretty much guarantees
 
every assertion is HoK.  If there is no <saml:Subject> in the request,
 
we've chosen to interpret that as HoK subject confirmation using
 
<ds:X509Certificate>, so "strongly matches" still applies
 
(implicitly).