Opinions on SIDP-570?

[Cantor, Scott]

> Yes of course*.  I was thinking of something pretending to be known service
> X.

Location veification of the response endpoint is how we prevent that absent signing the request. Encryption is a way to mitigate the fallout of sending data to an endpoint that turns out to be bogus, which would be a failure in the registration of the metadata, or a straight MITM attack against the browser.

> If I provide a SAML response encrypted with X's key, the reply should be
> useless to the impostor.

Yes.

>  Would having the service sign the original request
> with its key provide significant additional security (assuming of course I check
> the validity of the signature and refuse to proceed with an invalid signature)?

Yes. It can obviate the need for endpoint registration in metadata, which is very nice when you have hundreds of vhosts, but it's worthless unless all the IdPs one deals with accept signatures for that purpose (and you don't have to support legacy protocols).

-- Scott