HTTPRedirectDeflateEncoder removing AuthnRequest signatures?

[Misagh Moayyed]

On 9/1/16, 10:32 AM, "dev on behalf of Misagh Moayyed" <dev-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote: 

> Once the code has built an AuthnRequest object, among other things none of which are 
> relevant, attempts to invoke “SAMLOutboundProtocolMessageSigningHandler" on the outbound 
> context to sign the request. When the call returns, I can actually verify and see that the 
> request is properly signed. 

Do you mean signed in XML terms? 
Yes, if I understand your correctly. My method of confirmation is to basically check to see if the authn request object carries a signature, mostly via isSigned().



> Then, when the code attempts to encode the request via “HTTPRedirectDeflateEncoder", the 
> signature on the singable object is removed apriori. As a result, the authn request 
> received by the IdP is never signed. 

The redirect binding can't carry signed XML, it's too large (whether in any given case is immaterial, it's not designed to do that). Signing with that binding is done at the binding level with a specialized algorithm. 
Could I ask you to elaborate a bit more on this? Binding level, when? And what sort of specialized algorithm? 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160901/3779eba8/attachment.html>