<head>
<style>
code {
font-family: SFMono-Regular, Menlo, Consolas, "PT Mono", "Liberation Mono", Courier, monospace;
}
p {
border-radius: 0px;
}
ol.custom-editor-ordered-list-class {
padding-inline-start: 0px;
margin: 1px 0px;
padding-inline-start: 24px;
min-height: calc(1.5em + 6px);
}
ul.custom-editor-bullet-list-class {
padding-inline-start: 0px;
margin: 1px 0px;
padding-inline-start: 24px;
min-height: calc(1.5em + 6px);
}
pre.custom-editor-code-block-class {
flex-shrink: 1;
text-align: left;
font-family: SFMono-Regular, Menlo, Consolas, "PT Mono", "Liberation Mono", Courier, monospace;
font-size: 13.6px;
tab-size: 2;
padding: 34px 16px 32px 32px;
min-height: 1em;
white-space: pre;
border-radius: 4px;
text-align: left;
position: relative;
background: rgba(135,131,120,.15);
min-width: 0px;
width: 100%;
box-sizing: border-box;
}
hr.custom-editor-divider-class {
border: none;
border-top: 1px solid rgba(135,131,120,.15);
width: 100%;
}
blockquote {
border-left: 3px solid currentcolor;
padding-inline-start: 14px;
margin: 0px;
margin-top: 4px;
font-size: 1em;
padding-right: 2px;
padding-top: 3px;
padding-bottom: 3px;
padding-left: 14px;
}
blockquote.light {
border-left-color: rgba(55, 53, 47, 0.16);
}
blockquote.dark {
border-left-color: rgba(255, 255, 255, 0.13);
}
aside {
display: flex;
width: 100%;
max-width: 100%;
box-sizing: border-box;
border-radius: 4px;
background: rgba(135,131,120,.15);
padding: 16px 16px 16px 12px;
white-space: pre-wrap;
word-break: break-word;
}
.callout-emoji {
user-select: none;
display: flex;
align-items: center;
justify-content: center;
height: 24px;
width: 24px;
font-size: 21.6px;
box-sizing: border-box;
margin-top: -3px;
border-radius: 0.25em;
flex-shrink: 0;
flex-grow: 0;
}
.callout-emoji > img {
height: 18px;
width: 18px;
margin-top: auto;
margin-bottom: auto;
}
.callout-content {
margin-left: 8px;
margin-top: auto;
display: table;
width: 100%;
}
.custom-editor-task-list-class {
list-style: none;
padding: 0;
margin: 0;
}
.custom-editor-task-item-class {
display: flex;
align-items: center;
}
.custom-editor-task-item-class > label {
margin-right: 0.5rem;
cursor: pointer;
user-select: none;
display: flex;
align-items: center;
}
.custom-editor-task-item-class > label > input[type="checkbox"] {
margin-right: 0.5rem;
}
.custom-editor-task-item-checked-class > * {
text-decoration: line-through rgba(55, 53, 47, 0.42);
color: rgba(55, 53, 47, 0.65);
}
.custom-editor-rendered-mention {
opacity: 0.6;
color: unset;
}
.custom-editor-rendered-mention > a {
color: unset;
}
.custom-editor-rendered-mention-page {
font-weight: 500;
max-width: 200px;
}
.custom-editor-rendered-mention-page > a {
color: unset;
}
.custom-editor-rendered-mention-page-link {
border-bottom: 0.05em solid rgba(95, 94, 91, 1);
text-decoration: none !important;
}
pre {
flex-shrink: 1;
text-align: left;
font-family: SFMono-Regular, Menlo, Consolas, "PT Mono", "Liberation Mono", Courier, monospace;
font-size: 13.6px;
tab-size: 2;
padding: 34px 16px 32px 32px;
min-height: 1em;
white-space: pre;
border-radius: 4px;
text-align: left;
position: relative;
background: rgb(247, 246, 243);
min-width: 0px;
width: 100%;
box-sizing: border-box;
text-wrap: wrap;
}
a.custom-editor-link-class {
color: rgba(120, 119, 116, 1);
cursor: pointer;
text-decoration-thickness: 0.05em;
text-underline-offset: 3px;
}
</style>
<style>
* {
-webkit-tap-highlight-color: rgba(0, 0, 0, 0);
-webkit-font-smoothing: antialiased;
line-height: 1.3;
font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, "Apple Color Emoji", Arial, sans-serif, "Segoe UI Emoji", "Segoe UI Symbol";
}
p {
margin: 0px 0px 0px 0px !important;
min-height: 19.5px; /* Set a minimum height so empty p tags still take up vertical space; matches gmail empty line height */
}
</style>
</head>
<body>
<p dir="auto">IPSIE WG,</p><p dir="auto"></p><p dir="auto">Please see <a target="_blank" rel="noopener noreferrer nofollow" class="custom-editor-link-class" href="https://github.com/openid/ipsie/issues/105">https://github.com/openid/ipsie/issues/105</a> and provide feedback. I have copied the text of the issue below for your convenience.</p><p dir="auto"></p><hr class="custom-editor-divider-class"><p dir="auto">Over the past few weeks, the WG has held a number of discussions about the ways that SAML does not operate like OIDC. The WG has a very rough consensus from call attendees that we should not include any requirements in SL1 that would block existing SAML implementations from becoming compliant. However, we have not yet identified the list of gaps in SAML that would block existing SAML implementations from reaching SL1 with our current outcomes (see <a target="_blank" rel="noopener noreferrer nofollow" class="custom-editor-link-class" href="https://github.com/openid/ipsie/blob/main/ipsie-levels.md" style="box-sizing:border-box;background-color:rgba(0,0,0,0);color:rgb(9,105,218);text-decoration:underline"><u>https://github.com/openid/ipsie/blob/main/ipsie-levels.md</u></a>) and common requirements (see <a target="_blank" rel="noopener noreferrer nofollow" class="custom-editor-link-class" href="https://github.com/openid/ipsie-common-requirements-profile" style="box-sizing:border-box;background-color:rgba(0,0,0,0);color:rgb(9,105,218);text-decoration:underline"><u>https://github.com/openid/ipsie-common-requirements-profile</u></a>). As highlighted on the August 12, 2025 call, we run the risk of implementing requirements in OIDC SL1 which cannot be met in SAML SL1 that may require changing OIDC SL1 after the interop.</p><p dir="auto" style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;font-family:-apple-system,"system-ui","Segoe UI","Noto Sans",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">In order to avoid significant changes to OIDC SL1 to accommodate SAML SL1, please use this issue to document all known gaps in current SAML implementations/protocol specifications that would block SAML implementations from achieving SL1 as we have defined the outcomes today.</p><p dir="auto" style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;font-family:-apple-system,"system-ui","Segoe UI","Noto Sans",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">I'll include two examples below.</p><ol class="custom-editor-ordered-list-class" dir="auto"><li dir="auto"><p dir="auto">IdP-initiated SAML federations are in wide use today. Blocking IdP-initiated federation, as is proposed in <a target="_blank" rel="noopener noreferrer nofollow" class="custom-editor-link-class" href="https://github.com/openid/ipsie-common-requirements-profile" style="box-sizing:border-box;background-color:rgba(0,0,0,0);color:rgb(9,105,218);text-decoration:underline"><u>https://github.com/openid/ipsie-common-requirements-profile</u></a> based on the NIST800-63 rev4 requirements at FAL2 would preclude most SAML implementation from reaching SL1. The recommendation is to allow IdP-init at SL1 and disallow IdP-init at SL2+.</p></li><li dir="auto"><p dir="auto">SAML does not have a defined mechanism for communicating <code class="custom-editor-code-class">amr</code> claims. There are custom <a target="_blank" rel="nofollow" class="custom-editor-link-class" href="https://developer.okta.com/docs/guides/configure-claims-sharing/thirdpartysaml/main/" style="box-sizing:border-box;background-color:rgba(0,0,0,0);color:rgb(9,105,218);text-decoration:underline"><u>mechanisms</u></a>, but no normative standard. The recommendation is that IPSIE define a normative mechanism for custom <code class="custom-editor-code-class">amr</code> style claims in SAML that can be included in the SAML SL1 profile.</p></li></ol><p dir="auto"></p><hr class="custom-editor-divider-class"><p dir="auto"></p><div class="signature"><p dir="auto">--</p><div dir="auto"><p dir="auto">Dean H. Saxe</p></div><div dir="auto"><p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" class="custom-editor-link-class" href="mailto:dean@thesax.es">dean@thesax.es</a></p></div></div>
</body>