OpenSAML user discussion

["Scott Cantor" <>]

> Is it the "Response" type that is considered "credentials" or is it the
> individual assertions?

As Tom noted, there are no real use cases where putting a SAML protocol
message in a SOAP header would ever make any sense. You put assertions in
headers, not protocol messages.

> I need to store in header the results of authn...this would be the
> Response right? Because there may be multiple Assertions so you need a
> container and this is Response, correct?

No, it's the Security header.

-- Scott