<s:Envelope xmlns:s="http://schemas.xmlsoap.org /soap/envelope/"
         xmlns:sb="urn:liberty:sb:20 05-11"
         xmlns:sec="urn:liberty:security:2005-11"
         xmlns:wsse="http://docs.oasis-open.org/wss/20 04/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis- 200401-wss-wssecurity-utility-1.0.xsd"
         xmlns:wsa="http://www.w3.org/2005/08/ addressing"
         xmlns:ds="http://www.w3.org/2000/0 9/xmldsig#"
         xmlns:xenc="http://www.w3.org/2001 /04/xmlenc#">
 <s:Header>
   <!-- see Liberty SOAP Binding Specification for which headers
       are required and optional -->
   <wsa:MessageID wsu:Id="mid">...</wsa:MessageID>
   <wsa:To wsu:Id="to">...</wsa:To>
   <wsa:Action wsu:Id="action">...</wsa:Action>
   <wsse:Security mustUnderstand="1">
    <wsu:Timestamp wsu:Id="ts">
      <wsu:Created>2005-06-17T04:49:17Z</wsu:Created>
    </wsu:Timestamp>
    <!-- this is the bearer token -->
    <saml2:Assertion
        xmlns:saml2="urn:oasis:names:tc:SAML:2. 0:assertion"
        Version="2.0"
        ID="sxJu9g/vvLG9sAN9bKp/8q0NKU="
        IssueInstant="2005-04-01T16:58:33.173Z">
      <saml2:Issuer>http://authority.ex ample.com/</saml2:Issuer>
      <!-- signature by the issuer over the assertion -->
      <ds:Signature>...</ds:Signature>
      <saml2:Subject>
        <saml2:EncryptedID>
         <xenc:EncryptedData>U2XTCNvRX7 Bl1NK182nmY00TEk==</xenc:EncryptedData>
          <xenc:EncryptedKey>...</xenc:EncryptedKey>
        </saml2:EncryptedID>
        <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0: cm:bearer">
        </saml2:SubjectConfirmation>
      </saml2:Subject>
      <!-- By placing an audience restriction on the assertion we
           can limit the scope of which entity should consume
           the information in the assertion. -->
      <saml2:Conditions
          NotBefore="2005-04-01T16:57:20Z"
          NotOnOrAfter="2005-04-01T21:42:4 3Z">
        <saml2:AudienceRestrictionCondition>
          <saml2:Audience>http://wsp.example.com</saml2:Audience>
        </saml2:AudienceRestrictionCondition>
      </saml2:Conditions>
      <!-- The AuthnStatement carries information
           that describes the authentication event
           of the Subject to an Authentication Authority -->
      <saml2:AuthnStatement
          AuthnInstant="2005-04-01T16:57:30.000Z"
          SessionIndex="6345789">
        <saml2:AuthnContext>
          <saml2:AuthnContextClassRef>
            urn:oasis:names:tc:SAML:2.0:ac: classes:PasswordProtectedTra nsport
          </saml2:AuthnContextClassRef>
        </saml2:AuthnContext>
      </saml2:AuthnStatement>
      <!-- This AttributeStatement carries an EncryptedAttribute.
           Once this element is decrypted with the supplied key
           an <Attribute> element bearing an endpoint reference
           can be found, specifying resources which the invoker may
           access. Details on this element can be found in the
           discovery service specification. -->
      <saml2:AttributeStatement>
        <saml2:EncryptedAttribute>
          <xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" >
            mQEMAzRniWkAAAEH9RWir0eKDkyFAB7PoFazx3ftp0v WwbbzqXdgcX8fpEqSr1v4=
          </xenc:EncryptedData>
          <xenc:EncryptedKey> ... </xenc:EncryptedKey>
        </saml2:EncryptedAttribute>
      </saml2:AttributeStatement>
    </saml2:Assertion>
    <!-- This SecurityTokenReference is used to reference the SAML
    Assertion from a ds:Reference -->
    <wsse:SecurityTokenReference
       xmlns:wsse="..." xmlns:wsu="..." xmlns:wsse11="..."
       wsu:Id="str1"
       wsse11:TokenType="http://docs.oasis-open. org/wss/oasis-wss-saml-token-p
rofile-1.1#SAMLV2.0">
      <wsse:KeyIdentifier
         ValueType="http://docs.oasis-open.org/wss/oasis-wss-sam l-token-profile-1.1#SAMLID">
        sxJu9g/vvLG9sAN9bKp/8q0NKU=
      </wsse:KeyIdentifier>
    </wsse:SecurityTokenReference>
    <ds:Signature>
      <ds:SignedInfo>
       <!-- in general include a ds:Reference for each wsa: header
           added according to SOAP binding -->
       <!-- include the MessageID in the signature -->
       <ds:Reference URI="#mid">...</ds:Reference>
       <!-- include the To in the signature -->
       <ds:Reference URI="#to">...</ds:Reference>
       <!-- include the Action in the signature -->
       <ds:Reference URI="#action">...</ds:Reference>
       <!-- include the MessageID in the signature -->
       <ds:Reference URI="#mid">...</ds:Reference>
       <!-- include the Timestamp in the signature -->
       <ds:Reference URI="#ts">...</ds:Reference>
       <!-- include the SAML Assertion in the signature to avoid
           token substitution attacks -->
       <ds:Reference URI="#Str1">
         <ds:Transform Algorithm="...#STR-Transform">
          <wsse:TransformationParameters>
            <ds:CanonicalizationMethod
              Algorithm="http://www.w3.org/TR/2001/REC-xml-c 14n-20010315" />
          </wsse:TransformationParameters>
         </ds:Transform>
       </ds:Reference>
       <!-- include the message body -->
       <ds:Reference URI="#MsgBody">
         <!-- bind to the body -->
       </ds:Reference>
      </ds:SignedInfo>
      ...
    </ds:Signature>
   </wsse:Security>
 </s:Header>
 <s:Body wsu:Id="MsgBody">
   <xx:Query/>
 </s:Body>
</s:Envelope>
