How to sign AuthnRequest with HTTP-Post binding

[John Shimek]

On Thursday, August 2, 2012 at 9:35 AM, Cantor, Scott wrote:
> On 8/1/12 9:54 PM, "John Shimek" <jshimek at code42.com (mailto:jshimek at code42.com)> wrote:
> > 
> > I am appologise if I missed this in the documentation somewhere, but how
> > do I sign an authn request that is submitted via the HTTP-post bindings
> > with opensaml. I have found how you add the signature to the url for a
> > redirect binding, but not for an http-post
> > binding.
> > 
> 
> 
> You didn't even indicate what language you mean, but AFAIK in the code of
> both versions it's binding independent in the API, it's a matter dealt
> with by the message encoders.
> 
> -- Scott

I keep forgetting the OpenSAML has a C# version. I am working with Java. Can you explain what you mean by message encoders? In my case, I have an AuthnRequest that I Base64 encode and place into the HMTL form that is posted to the IdP. In the case of a redirect binding, I found that a signature is generated based on the AuthnRequest and added a a parameter to the IdP's urls. Something like 


http://idp.com/SSO/POST?SAMLRequest=request&Signature=The-Signature&SigAlg=The-Signature-Algorithm

So the signature is not in the AuthnRequst. It is supplied with the request. When I POST my request, do I include the Signature and SigAlg parameters as hidden fields in my form as well?

Thank you,
John
 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120802/cda15723/attachment.html