<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div>
<blockquote type="cite" class="">
<div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Today,
SAML metadata points at certificates in various ways through X509<blah> elements. I want the link in the other direction. I don't know why yet, but it feels completely right. I have to think to get why.</span></div>
</blockquote>
</div>
<br class="">
<div class="">I think it's who versus what, again. Who I am is a fairly persistent or permanent thing. "What" I say changes all the time, such as my GUI info or the endpoints I'll be using.</div>
<div class=""><br class="">
</div>
<div class="">"Who" can't change often, just in terms of human capacity, making a more permanent token for that purpose and that purpose alone interesting. Once I have someone to sue, things become much less serious, and I can start thinking about the "what",
so the flexibility that simpleSSO gives is defensible.</div>
<div class=""><br class="">
</div>
<div class="">Since "who" shouldn't change often and it must be matched, that's where I want my pointer to live. That's the "glue point". So, put the pointer to metadata in the certificate.</div>
<div class=""><br class="">
</div>
<div class="">SAML metadata alone kinda already has this problem without the distinction, now that you mention it. Consider how hard it is to change your entityID. Consider how easy it is to change anything else.</div>
<div class=""><br class="">
</div>
<div class="">simpleSSO uses certificates to say "who", leaving it hard to change your "who" and easy to change anything else. This gives strict assignment of authority, but a way to check "what" with multiple attesters, including your counterparty if you
so choose.</div>
</body>
</html>