Thomas Wisniewski wrote:
> All, here are some additional assumptions we should consider:
>
> - Each SP should support/define only a single assertion consumer
> endpoint. I would recommend that index 0 be used for that endpoint.
> This implies that if an AuthnRequest asks for a specific endpoint, it
> will be the 0-indexed endpoint.
>
Agree, each SP's metadata file just includes a single assertion
consumer service
with the binding being HTTP-POST and the index being 0.
> - For a Response, we should decide on whether we are signing the
> Response or the Assertion (i.e., only use one approach).
>
Lets just sign the Response, i.e., the root element.
> Tom.
>
