

RE: SAML simple sign

From: Scott Cantor <cantor.2@osu.edu>
Date: Fri, 15 Aug 2008 12:47:53 -0400
To: "'Sean Mullan'" <Sean.Mullan@Sun.COM>, <public-xmlsec@w3.org>
Message-ID: <011001c8fef6$a9800b10$fc802130$@2@osu.edu>

> Does anyone have a reference to the SAML simple sign mechanism or can
> explain it in more detail?


There's not much to explain, it signs an entire XML document as a blob using
a medium (HTTP forms) where a signature can accompany the document
separately. It's somewhat like S/MIME, except that the same people who
refuse to use XML Signature aren't generally any more enamored of S/MIME,
and using multipart submissions is just harder to get a browser to handle. A
non-browser use case wouldn't be as hostile to S/MIME as a solution.

I anticipate similar mechanisms or S/MIME itself being the obvious choice to
secure web services, particularly without SOAP.
-- Scott
Received on Friday, 15 August 2008 16:48:37 GMT
