Subject: [OAUTH-WG] Confirmation (was draft-ietf-oauth-saml2-bearer-17)

From: Brian Campbell <[email-masked]>
Date: Mon, 4 Nov 2013 11:59:17 -0800

On Sat, Nov 2, 2013 at 2:07 AM, Hannes Tschofenig
<[email-masked]> wrote:
> Item #5: You write:
>
> "
> The <Subject> element MUST contain at least one
>         <SubjectConfirmation> element that allows the authorization
>         server to confirm it as a Bearer Assertion.
> "
>
> What do you mean that the AS confirms that it is a bearer assertion?

Confirmation is a term from SAML which is honestly not well understood
by many people (myself included) but I'm trying to be consistent with
that in how I use it here. But it's not necessary and #5 is just
stating how the <SubjectConfirmation> element needs to look. Perhaps
rewording it to just not use the confirm language would be better?

> I think
> what you rather want to say is that the AS indicates that it is a bearer
> assertion.

No, it's just language around what needs to be validated in the
<SubjectConfirmation> element of the assertion because it is a bearer
assertion.