Validation of InResponseTo field in a Java-based SP
Misagh Moayyed
mmoayyed at unicon.net
Thu Jul 16 17:15:58 EDT 2015
I am reviewing a piece of code in a java application that attempts to utilize open-saml v3 functionality as an SP. The code seems to execute validation processes on the response received and one of the checks that it does is, it makes sure the response.getInResponseTo() is not null or an exception is thrown. While this check appears to work in SP initiated authN, it proves impractical for IdP initiated authN as the call always returns null.
My questions are: is the check really necessary and does it provide value? and assuming that it is, what might be a proper strategy to make sure the code can work in both SP and IDP initiated authN modes?
- Misagh
More information about the dev
mailing list