the saml2p:Scoping block in authn requests

[Wessel, Keith]

Hi, all,

Is there any risk of building an authn request that doesn't include the <saml2p:Scoping> block? We're creating a lightweight script that performs an ECP authentication against our IdP and sends the response to Amazon to generate command-line and AWS API access tokens. Our developer was asking about some simplifications to the code, and this was the one I couldn't answer.

It seems that the IdP will accept a request without this block. I assume it's optional, and the only thing it ensures if it's included and contains an IdP entityID is that the IdP won't respond to it if its entityID isn't listed. But if the receiving SP is checking the issuer of the response, that security check ishappening later, anyway.

Am I missing something?

Thanks,
Keith