RE: [saml-dev] NameID-less SAML Subject

> Suppose I want to query an IdP and identify the subject with an X.509
> certificate (not merely a DN).  I'd be tempted to include the cert in
> a SubjectConfirmation element but the semantics aren't quite right.
> What is the correct way to do this?

Second option I just thought of would be base64-ing the certificate,
defining a Format, and using it inside NameID.

-- Scott