the saml2p:Scoping block in authn requests

[Wessel, Keith]

I didn't say I thought it was normal; it was just in the ECP excerpt that we started with, and at this point, I can't remember where we even started. Makes me think we should pass through the rest of the authn request to make sure we don't have other unneeded elements.

Thanks, Scott, that's exactly what I needed to know.

Keith


-----Original Message-----
From: dev <dev-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, April 4, 2018 4:01 PM
To: Shib Dev <dev at shibboleth.net>
Subject: RE: the saml2p:Scoping block in authn requests

> Is there any risk of building an authn request that doesn't include 
> the <saml2p:Scoping> block?

Nobody really uses Scoping, what makes you think it's normal to use it?

> It seems that the IdP will accept a request without this block. I 
> assume it's optional, and the only thing it ensures if it's included 
> and contains an IdP entityID is that the IdP won't respond to it if 
> its entityID isn't listed. But if the receiving SP is checking the 
> issuer of the response, that security check ishappening later, anyway.

Scoping is for proxying. It supposedly controls where the IdP will proxy a request back to. An SP setting it that doesn't rely on a single IdP proxy doesn't have any idea what it's doing.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net