> Turning to the description of AssertionConsumerServiceIndex
> in core, the sentence "It applies only to profiles in which
> the request issuer is different from the presenter" confuses
> me even further. Does this mean that the Web SSO profile does
> not use this attribute?
No, the SSO profile is one example in which the request issuer (the SP) is
different from the presenter (the browser).
Contrast this with a hypothetical profile for use by a smarter client that
is, perhaps, SOAP-aware. Such a client could itself request assertions
directly using the SOAP binding, and there's no notion of
"AssertionConsumerService" there. The client takes the assertions it gets
and uses them as desired.
I thought it worth noting this distinction, but my language for doing so was
obviously very brief and vague.
-- Scott
