Store IdP in SP session before authentication?

[Cantor, Scott]

On 10/30/18, 12:21 PM, "dev on behalf of Lukas Hämmerle" <dev-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch> wrote:

> What do you mean by "whatever protection" in this case?

I'm saying whatever benefit they're seeking doesn't actually matter if you can send it an unsolicited response because whatever "attack" somebody is trying to pull off (presumably a XSRF attempt) is still going to be possible as long as the attacker doesn't start at the SP and allow it to store off any request state for that login.

> I'm not sure what SSP supports in this regard but it seems to block an
> assertions by default if they come from an IdP that it did not expect.

If I just send it a response from an IdP without letting it make a request first, does it block that? If not, they haven't gained anything but blocking the world's stupidest attacker. If they do, then they're disabling unsolicited responses.

-- Scott