[ http://tools.oasis-open.org/issues/browse/SECURITY-6?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Scott Cantor updated SECURITY-6:
--------------------------------
Proposal:
Change text in 4.1.3.5 of Profiles to:
"Regardless of the success or failure of the <AuthnRequest>, the identity provider SHOULD produce and send an HTTP response to the user agent containing a <Response> message under any circumstances within its control, and implementations SHOULD provide deployers with the ability to guarantee responses where possible."
Resolution: Proposal accepted on 4/6/10 TC call.
> PE: Conflict with core in SSO profile on returning error Responses to SP
> ------------------------------------------------------------------------
>
> Key: SECURITY-6
> URL: http://tools.oasis-open.org/issues/browse/SECURITY-6
> Project: OASIS Security Services (SAML) TC
> Issue Type: Bug
> Components: Profiles
> Affects Versions: Version 2.0
> Reporter: Scott Cantor
> Priority: Minor
> Fix For: 2.0 incorporating Approved Errata
>
>
> Section 3.4.1.4 of Core states that "The responder MUST ultimately reply to an <AuthnRequest> with a <Response> message..." regardless of success or failure.
> Section 4.1.3.5 of Profiles reads "Regardless of the success or failure of the <AuthnRequest>, the identity provider SHOULD produce an HTTP response to the user agent containing a <Response> message...".
> The conflicting language should be clarified, without imposing the impossible requirement for an IdP to guarantee a response, but to encourage implementers to favor responses and/or provide options to ensure that.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
