[abfab] Barry Leiba's No Objection on draft-ietf-abfab-aaa-saml-13: (with COMMENT)

["Barry Leiba" <[e-mail]>]

Barry Leiba has entered the following ballot position for
draft-ietf-abfab-aaa-saml-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-abfab-aaa-saml/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Because abfab-arch defines the terms "Client", "Relying Party", and 
"Identity Provider", I think abfab-arch should be a normative reference.

-- Section 3 --

   The RADIUS SAML binding defined in Section 4 of this document uses
   two attributes to convey SAML assertions and protocol messages
   respectively [OASIS.saml-core-2.0-os]

Nit: "respectively" is out of place here, and should be removed.  You 
would only use "respectively" if you named the two attributes ("...uses 
two attributes, SAML-Assertion and SAML-Protocol, to convey SAML 
assertions and protocol messages, respectively.").

-- Section 7.3.5 --

   If issued by the Identity Provider, the Relying Party MUST process
   the <samlp:Response> message and any enclosed assertion elements as
   described in [OASIS.saml-core-2.0-os]

"If issued" is dangling, and  makes it look like the Relying Party is 
issued by the Identity Provider.

NEW
   If a <samlp:Response> message is issued by the Identity Provider,
   the Relying Party MUST process that message and any enclosed
   assertion elements as described in [OASIS.saml-core-2.0-os]
END

-- Section 11.2 --
Thank you; this section is well done.