> However, to "fulfill" the words of the spec even such a
> "direct request" must carry the TARGET parameter, which then
> leads to funny URL's like this one:
>
> http://host/application/calculator?TARGET=http://host/applicat
> ion/calculator&SAMLart=12353625363457236457
>
> (/application/calculator is the business application!).
Yes, but how is the arbitrary SAML identity provider (the source site)
supposed to know that it can omit the TARGET for your resource and not
mine?
I suppose you could configure it, but that seems like a lot of wasted
effort to avoid such a trivial thing, especially since it's not a
bookmark-able URL anyway. If it were, I'd say you have a laudable goal,
but...
-- Scott
