How to sign AuthnRequest with HTTP-Post binding

[Cantor, Scott]

>I keep forgetting the OpenSAML has a C# version.

C++, not C#.

> I am working with Java. Can you explain what you mean by message
>encoders?

The OpenSAML abstraction for handling the bindings.

> In my case, I have an AuthnRequest that I Base64 encode and place into
>the HMTL form that is posted to the IdP.

If you do it all manually then you would have to do the signature work
using the low level routines. You could find examples that are analagous
in the IdP code that signs assertions, or just find the encoder for POST
and it should have logic in it for signing.

>So the signature is not in the AuthnRequst. It is supplied with the
>request. When I POST my request, do I include the Signature and SigAlg
>parameters as hidden fields in my form as well?

No, not unless you're using POST-SimpleSign, which more or less works
exactly like that.

-- Scott