scott cantor bqbvdn6osuedu would say idp retain enough state produce authnstatement internally consistent ie content describes authentication event fact compliant thus idp preserve time user presented password claim password ac first authnstatement must henceforth use existingsession ac thats fine im simply pointing saml 11 authn method defined spec implementations behave way think noncompliant words meaning timestamp deploymentspecific since theres rarely mention existingsession ac class struck odd one could argue saml 20 changed constraint without changing relevant language spec least note hey authn method class makes difference clear tom says think errata scott unsubscribe email zwuiopcitsxkbbpazwlistsoasisopenorg additional commands email rnzpzqvxvvklistsoasisopenorg tue 05 aug 2008 233122 0500 samldev value authninstant