HTTPRedirectDeflateEncoder removing AuthnRequest signatures?

[Misagh Moayyed]

Background: I am working with a piece of code that attempts to create signed authn requests based on opensaml 3.2. (tried with 3.1 as well) 

Once the code has built an AuthnRequest object, among other things none of which are relevant, attempts to invoke “SAMLOutboundProtocolMessageSigningHandler" on the outbound context to sign the request. When the call returns, I can actually verify and see that the request is properly signed. 

Then, when the code attempts to encode the request via “HTTPRedirectDeflateEncoder", the signature on the singable object is removed apriori. As a result, the authn request received by the IdP is never signed. I can see this, because when the IdP receives and decodes the authn request, isSigned() is always false. If I mod the encoder to not remove the signature prior to it encoding, the resulting authn request received by the IdP turns out to be signed via isSigned() being true. 

Is the order of operations correct? What might I be missing to let signed authn requests be received by the IdP? 

-- 
Misagh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160901/3847f885/attachment.html>