text_combined: tom scavo mkjirtzgmailcom agree conor well still think errata required length thread evidence clarification issue needed tom feb 13 2008 1036 ari kermaier wrote agree conor authninstant specific act authentication described rest authnstatement whatever time value idp happens access tofeels like putting otherwise seems use recipient statement specs intent considerate idps dont save details original user authentication context authninstant optional arbitrary value ari original message cahill conor p mailtoeomqplcwyrpvintelcom sent monday february 11 2008 421 pm scott cantor tom scavo cc saml developers subject samldev value authninstant think youre mixing apples oranges yes cookie could considered form authentication however idp says ac user presented usernamepassword authninstant took place session cookie presented idp yes authncontext says got cookie authninstant match issueinstant conor original message scott cantor mailtobqbvdn6osuedu sent monday february 11 2008 406 pm cahill conor p tom scavo cc saml developers subject samldev value authninstant contrived yes presume certificate presented idp would count time idp walks authentication sequence authentication event wouldcould impact authninstant authentication doesnt imply user involved thats different use cookie relative strength aside fact ac spec includes context class existing session whats case tom brought walk new authentication sequence idp rather used existing session user pretty clear authninstant shouldnt updated case value original authentication event bearer token form authentication cookie bearer token idp decides implement without retaining enough state remember original time compliant core says authninstant time authentication took place time assertion issued would say violate spirit setting unless define authentication differently glossary read verify think pretty clear dont think needs change disagree reasoning knowing something illegal able point specific statements spec make much easier sp homework get right expected behavior hasnt experience either way think spec clear dont think requires behavior think intentionally vague precisely issue dating back saml 1 fact brought number occasions back told implementer scott unsubscribe email zwuiopcitsxkbbpazwlistsoasisopenorg additional commands email rnzpzqvxvvklistsoasisopenorg unsubscribe email zwuiopcitsxkbbpazwlistsoasisopenorg additional commands email rnzpzqvxvvklistsoasisopenorg unsubscribe email zwuiopcitsxkbbpazwlistsoasisopenorg additional commands email rnzpzqvxvvklistsoasisopenorg tue 05 aug 2008 232930 0500 samldev value authninstant