Doubt about empty reference URI element

[Cantor, Scott]

On 4/24/16, 8:08 AM, "dev on behalf of Sixto Garcia" <dev-bounces at shibboleth.net on behalf of sixto.garcia at onelogin.com> wrote:



>This is not a specific shibboleth question but I didn't know where to ask it.

The OASIS saml-dev list.

>Are empty reference URI at Signatures element allowed in the SAML standard?

Not formally in 2.0, no.

>The XMLSignatureValidationStage, because it is usable on any signed XML, does not enforce the SAML requirement that the signature refers to the ID on the document element, and instead allows a signature reference of "".

Yes, because it's handling things that are not SAML.

>So may be not strictly allowed, but shibboleth at least seems to support it on Signed Metadata.

Shibboleth supports older SAML versions that don't have the same explicit requirements, and those of us on the project understand the issues enough to know when it's safe to permit it and when it's not safe. If you have to ask the question, you probably shouldn't allow it.

-- Scott