Simulating Invalid Request From RP

[Cantor, Scott]

On 12/1/11 9:48 AM, "Zmuda, Matthew R" <Matthew.R.Zmuda at td.com> wrote:

>
>What do I do / Where do I corrupt the signature?
>This a code change needed or metadata change?

The SP doesn't sign requests by default. Aside from turning that on, you'd
have to prevent the URL from being submitted to the IdP, and tamper with
the signature parameter before doing it yourself.

-- Scott