OpenSAML user discussion

["Scott Cantor" <>]

> > > So basically looks like in our case the SAML assertion xml will be
> > passed through the URL parameters.

I think Tom covered the ground fairly well, but I thought I should point out
that for size reasons, you can't use the SAML 2.0 HTTP/Redirect binding to
carry a SAML response containing an assertion.

For that to be secure (i.e. useful beyond triviality), it has to be signed,
and a signed assertion won't fit on a URL in most user agents.

-- Scott