the saml2p:Scoping block in authn requests

[Cantor, Scott]

> Is there any risk of building an authn request that doesn't include the
> <saml2p:Scoping> block?

Nobody really uses Scoping, what makes you think it's normal to use it?

> It seems that the IdP will accept a request without this block. I assume it's
> optional, and the only thing it ensures if it's included and contains an IdP
> entityID is that the IdP won't respond to it if its entityID isn't listed. But if the
> receiving SP is checking the issuer of the response, that security check
> ishappening later, anyway.

Scoping is for proxying. It supposedly controls where the IdP will proxy a request back to. An SP setting it that doesn't rely on a single IdP proxy doesn't have any idea what it's doing.

-- Scott