cahill conor p eomqplcwyrpvintelcom use one perhaps contrived example using certificate prone caching users pin whats right timestamp last time entered pin every time key silently reused contrived yes presume certificate presented idp would count time idp walks authentication sequence authentication event wouldcould impact authninstant case tom brought walk new authentication sequence idp rather used existing session user pretty clear authninstant shouldnt updated case value original authentication event instance consider idp routinely sets issueinstant authninstant value implementation broken imho certainly doesnt violate spec stands least core core says authninstant time authentication took place time assertion issued would say violate spirit setting one reason id changing dont think would help knowing illegal something doesnt help sp idp gets wrong think lot would get wrong think better clear sp homework relying value think pretty clear dont think needs change disagree reasoning knowing something illegal able point specific statements spec make much easier sp homework get right expected behavior conor unsubscribe email zwuiopcitsxkbbpazwlistsoasisopenorg additional commands email rnzpzqvxvvklistsoasisopenorg tue 05 aug 2008 181258 0800 samldev value authninstant