HTTPRedirectDeflateEncoder removing AuthnRequest signatures?

[Cantor, Scott]

On 9/1/16, 10:32 AM, "dev on behalf of Misagh Moayyed" <dev-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:

> Once the code has built an AuthnRequest object, among other things none of which are
> relevant, attempts to invoke “SAMLOutboundProtocolMessageSigningHandler" on the outbound
> context to sign the request. When the call returns, I can actually verify and see that the
> request is properly signed. 

Do you mean signed in XML terms?
    
> Then, when the code attempts to encode the request via “HTTPRedirectDeflateEncoder", the
> signature on the singable object is removed apriori. As a result, the authn request
> received by the IdP is never signed.

The redirect binding can't carry signed XML, it's too large (whether in any given case is immaterial, it's not designed to do that). Signing with that binding is done at the binding level with a specialized algorithm.

-- Scott