<HTML>
<HEAD>
<TITLE>Re: [WRAP] Wrap Artifact Binding/Mobile Profile</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Hi Nat -<BR>
<BR>
As an optimization, can we combine the association request with the artifact request? In fact, why can’t the association handle <B>be</B> the artifact?<BR>
<BR>
For example, when the RP requests association, it can pass along all the request parameters that it normally would pass via the browser in the authentication request. The OP can then return the association handle/artifact along with the shared secret.<BR>
<BR>
The RP then redirects the user’s browser to the OP with the association handle. After the user authenticates, the OP redirects the browser back to the RP with the association handle.<BR>
<BR>
The RP then makes a direct server call back to the OP with the handle (and probably also the shared secret) to fetch the assertion.<BR>
<BR>
I think this scheme will save a couple round trips.<BR>
<BR>
Allen<BR>
<BR>
<BR>
<BR>
<BR>
On 2/11/10 9:55 PM, "Nat Sakimura" <<a href="sakimura@gmail.com">sakimura@gmail.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>If you look at my manuscript of the Artifact Binding (<a href="http://www.sakimura.org/specs/ab/1.0">http://www.sakimura.org/specs/ab/1.0</a> ) </SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>