Requirement for AudienceRestriction when AppliesTo provided may be overly restrictive

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Minor
    • SAML 2.0 Profile PR
    • Affects Version/s: SAML 2.0 Profile PR
    • Component/s: Spec
    • None
    • Hide

      Change the "MUST" to "SHOULD".

      Show
      Change the "MUST" to "SHOULD".

      The SAML 2.0 token profile currently says:
      If the request contains a <wsp:AppliesTo> element, then a <saml:AudienceRestriction> containing a <saml:Audience> element MUST be included with the value of that element.

      As part of the review of the draft SAML 1.1 token profile, Arun Nanda commented: "This is overkill IMO. If an IdP is an open IdP that issues 'unscoped' tokens for consumption by any RP, it should not be forced to encode an audience in the issued token just because the request included it. So, may be SHOULD is preferred here..."

            Assignee:
            Unassigned
            Reporter:
            Michael Jones (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated: