<div><span style="color: rgb(160, 160, 168); ">On Thursday, August 2, 2012 at 9:35 AM, Cantor, Scott wrote:</span></div>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>On 8/1/12 9:54 PM, "John Shimek" <<a href="mailto:jshimek@code42.com">jshimek@code42.com</a>> wrote:</div><blockquote type="cite"><div><div><br></div><div>I am appologise if I missed this in the documentation somewhere, but how</div><div>do I sign an authn request that is submitted via the HTTP-post bindings</div><div>with opensaml. I have found how you add the signature to the url for a</div><div>redirect binding, but not for an http-post</div><div>binding.</div></div></blockquote><div><br></div><div>You didn't even indicate what language you mean, but AFAIK in the code of</div><div>both versions it's binding independent in the API, it's a matter dealt</div><div>with by the message encoders.</div><div><br></div><div>-- Scott</div></div></div></span></blockquote><div><br></div><div>I keep forgetting the OpenSAML has a C# version. I am working with Java. Can you explain what you mean by message encoders? In my case, I have an AuthnRequest that I Base64 encode and place into the HMTL form that is posted to the IdP. In the case of a redirect binding, I found that a signature is generated based on the AuthnRequest and added a a parameter to the IdP's urls. Something like </div><div><br></div><div><br></div><div><code>http://idp.com/SSO/POST?SAMLRequest=request</code><code>&Signature=The-Signature&SigAlg=The-Signature-Algorithm<br></code></div><div><code><br></code></div><div><code>So the signature is not in the AuthnRequst. It is supplied with the request. When I POST my request, do I include the Signature and SigAlg parameters as hidden fields in my form as well?</code></div><div><code><br></code></div><div><code>Thank you,</code></div><div><code>John</code></div><div> </div><div><br></div>