Re: [security-services] proposed change to POST profile: send Responseinstead of Assertion

["Eve L. Maler" <eve.maler@sun.com>]

At 07:45 AM 1/30/02 -0800, RL 'Bob' Morgan wrote:
>On Wed, 30 Jan 2002, Eve L. Maler wrote:
> > If everyone else is convinced, I guess I am.  *If* everyone else
> > convinced?  Could an HTTP binding be made dead-simple enough to
> > "happen" to carry a SAML request or response?  If so, why didn't we
> > include it in SAML 1.0?
>
>We took a vote a few months back on whether the HTTP or SOAP binding
>should be mandatory-to-implement, and SOAP won (I have no idea why).
>Someone could have championed a HTTP binding for inclusion in the spec,
>but no one did.

I know that part, but we had a fairly fully worked-out HTTP binding already 
prepared.  (I'd sure like to see that published, even if non-normatively 
under our binding registration process, soon.)  If we change the POST 
profile as you suggest, it might be handy to have a FAQ answer for my 
question...

         Eve
--
Eve Maler                                    +1 781 442 3190
Sun Microsystems XML Technology Center   eve.maler @ sun.com