We ran into some inconsistencies while participating in the recent SAML interop. The WSS core specification describes a "Direct Reference" mechanism to be used with STRs. A Reference element with a URI attribute is used. When the referenced token is located within the Security header, the URI contains a shorthand XPointer reference to the token. In order for this to work, the token element must contain an attribute of type ID. WSS defines the wsu:Id attribute with type ID for naming the reference. Direct references within the message should not require token specific methods so we suggest the following actions be taken:
1) Errata to the WSS core to make it clear the tokens must have an attribute named wsu:Id.
2) Change to the SAML Token Profile to use an wsu:Id attribute or use a wsse:KeyIdentifier
Anthony Nadalin | work 512.838.0085 | cell 512.289.4122
