OpenSAML user discussion

[Mitchell Prentice <>]

Hello

 

I'm trying to understand the use of InclusiveNamespaces PrefixList in exclusive canonicalization. I understand that any prefixes in this list are handled as per the canonical xml recommendation. However, I don't really understand why they are used in signatures over SAML response and assertions.

 

The SAML v2.0 specification (core spec section 5.4.6) has an example with "#default saml ds xs xsi" that's used for both the response signature and the assertion signature but provides no explanation or recommendations regarding their use.

 

Is the InclusiveNamespace PrefixList necessary for signatures over either SAML responses or assertions? If so, specifically why?

 

What prefix list should be used for a SAML response signature? Is there a fixed list or some algorithm to determine what should be in the list?

 

What prefix list should be used for a SAML assertion signature?

 

If a signed SAML assertion is contained within a signed SAML response, does this make a difference to either prefix list?

 

Thanks

Mitch