OpenSAML user discussion

["Scott Cantor" <>]

> Probably not.  The security policy rules are meant to be stateless so
> that they can be used over many messages.  Storing the InResponseTo in
> the rule represents state and wouldn't allow you to use the rule across
> messages (as the message ID you're responding to would change).

Yes, I enforce it inside my SOAP client, but I don't have a use for it on
the front channel, so I don't think I even check it there. Maybe in the
logout handler somewhere, not sure. I know I tracked it so I could respond
properly, but that's just to satisfy the spec.

-- Scott