[OAUTH-WG] Confirmation (was draft-ietf-oauth-saml2-bearer-17)

Brian Campbell <bcampbell@pingidentity.com> Mon, 04 November 2013 20:00 UTC

MIME-Version: 1.0
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Mon, 04 Nov 2013 11:59:17 -0800
Message-ID: <CA+k3eCRb9rXKbhg_ngdfzmutJOUXYNQ+xkfDzZqvY8A7eHVpAA@mail.gmail.com>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "oauth@ietf.org WG" <oauth@ietf.org>
Subject: [OAUTH-WG] Confirmation (was draft-ietf-oauth-saml2-bearer-17)
Precedence: list

On Sat, Nov 2, 2013 at 2:07 AM, Hannes Tschofenig
<hannes.tschofenig@gmx.net> wrote:
> Item #5: You write:
>
> "
> The <Subject> element MUST contain at least one
>         <SubjectConfirmation> element that allows the authorization
>         server to confirm it as a Bearer Assertion.
> "
>
> What do you mean that the AS confirms that it is a bearer assertion?

Confirmation is a term from SAML which is honestly not well understood
by many people (myself included) but I'm trying to be consistent with
that in how I use it here. But it's not necessary and #5 is just
stating how the <SubjectConfirmation> element needs to look. Perhaps
rewording it to just not use the confirm language would be better?

> I think
> what you rather want to say is that the AS indicates that it is a bearer
> assertion.

No, it's just language around what needs to be validated in the
<SubjectConfirmation> element of the assertion because it is a bearer
assertion.

[OAUTH-WG] Confirmation (was draft-ietf-oauth-sam… Brian Campbell