OpenSAML user discussion

[Brent Putman <>]

Scott Cantor wrote:

I have read the specs but can't really figure out something. Does the
signature of a SAML token, with confirmation method set to
sender-vouches, needs to reference both the assertion and the binary
security token?
    

Please use saml-dev for SAML questions. However what you're asking isn't a
SAML question because signatures in SAML cover SAML only.

From what I know of WSS, it isn't even a valid question there because SAML
assertions are not binary security tokens.

  

I assumed he meant a binary security token that represents a signing key, for example an STR that lives in Assertion/Signature/KeyInfo or another Signature/KeyInfo in the Security header.

And I think no, the Assertion signature can't cover that.  Another signature might, I suppose.