title: What's the meaning of SubjectConfirmation in OAuth2 SAML authorization grant?
body: <p>The <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-saml2-bearer-15" rel="nofollow noreferrer">OAuth2 SAML bearer spec</a> describes how an application can present an assertion to a token endpoint <em>as an authorization grant</em>.  For example, <a href="http://help.salesforce.com/help/doc/en/remoteaccess_oauth_SAML_bearer_flow.htm" rel="nofollow noreferrer">Salesforce's API</a> allows this approach to enable apps to autonomously request access tokens for a user account (as long as the user has already given permission for this, out-of-band).</p>
  <p>I'm having trouble making sense of what the assertion means, though.  Most of it is clear enough, e.g.</p>
  <ul>
  <li><code>Issuer</code> is the party that generated (and signed) the assertion</li>
  <li><code>Subject</code> is the user for whose account an access token is being requested</li>
  <li><code>AudienceRestriction</code> limits the audience to the token endpoint.</li>
  </ul>
  <p>But I'm having trouble understanding the meaning of:</p>
  <ul>
  <li><p><code>AuthnStatement</code> -- My understanding from the SAML spec is that the issuer of this assertion is making the statement that it (the issuer) has authenticated the subject.  Is this right?</p>
  </li>
  <li><p><code>SubjectConfirmation</code> -- who is confirming what here?  The SAML spec helpfully states that this element &quot;Information that allows the subject to be confirmed&quot;.  But what is confirmation? And who performs it, and how, and when, and for what purpose?</p>
  </li>
  </ul>