AW: Error after succeeded authentication

[Ortner Nikolaus]

> Older SP versions didn't even support https, and the main issue is that there
> is no support for doing anything with the transport layer, only the signature
> on the metadata is intended to matter. So there's no advantage to https.

Well, yes. I was just wondering why http should be "preferred". In my IdP-world you'll sooner or later end up relying on https - when having a SP with unsigned metadata or when downloading a signature certificate. [but maybe I'm missing some point]

Kind regards.