On 2/12/13 10:42 AM, "Bernard Aboba" <[email protected]> wrote:
>Let me ask a potentially stupid question:
>
>Why can't we send a URL pointing to the {SAML Assertion, Certificate}
>instead of sending the data itself?
In addition to all of Alan's comments, there's the fact that you have to
secure the exchange over the URL, or punt and rely on artifact-style
short-lived references as a replacement for securing it.
-- Scott
_______________________________________________
abfab mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/abfab
