<html><head><style>body{font-family:Bookerly,Arial;font-size:14px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Bookerly,Arial;font-size:14px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div> <div id="bloop_sign_1472744864026560000" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px"><br></div></div> <div><blockquote type="cite" class="clean_bq" style="font-family: Bookerly, Arial; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div></div><div>On 9/1/16, 10:32 AM, "dev on behalf of Misagh Moayyed" <dev-bounces@shibboleth.net on behalf of mmoayyed@unicon.net> wrote:<span class="Apple-converted-space"> </span><br><br>> Once the code has built an AuthnRequest object, among other things none of which are<span class="Apple-converted-space"> </span><br>> relevant, attempts to invoke “SAMLOutboundProtocolMessageSigningHandler" on the outbound<span class="Apple-converted-space"> </span><br>> context to sign the request. When the call returns, I can actually verify and see that the<span class="Apple-converted-space"> </span><br>> request is properly signed.<span class="Apple-converted-space"> </span><br><br>Do you mean signed in XML terms?<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>Yes, if I understand your correctly. My method of confirmation is to basically check to see if the authn request object carries a signature, mostly via isSigned().</p><div><div><blockquote type="cite" class="clean_bq" style="font-family: Bookerly, Arial; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div><br><br>> Then, when the code attempts to encode the request via “HTTPRedirectDeflateEncoder", the<span class="Apple-converted-space"> </span><br>> signature on the singable object is removed apriori. As a result, the authn request<span class="Apple-converted-space"> </span><br>> received by the IdP is never signed.<span class="Apple-converted-space"> </span><br><br>The redirect binding can't carry signed XML, it's too large (whether in any given case is immaterial, it's not designed to do that). Signing with that binding is done at the binding level with a specialized algorithm.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>Could I ask you to elaborate a bit more on this? Binding level, when? And what sort of specialized algorithm? </p></div></body></html>