How to Ignore a Signature

[Henry B. Hotz]

Which attribute in which config file do I do that in?

If you mean the AuthnRequestsSigned="False" in the SPSSODescriptor in the SPs metadata file, I've already done that.  

The logs have an INFO message that the request isn't signed (which it is).  Then it proceeds to verify the signature anyway.  And fails because it doesn't have the key needed to verify the signature.

> 22:23:22.395 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed
> 22:23:22.395 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: .....
> 22:23:22.404 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:379] - Message did not meet security requirements org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer


On Aug 3, 2012, at 8:13 AM, Chad La Joie wrote:

> You can adjust the security policy for the SAML 2 authn request profile.
> 
> On Fri, Aug 3, 2012 at 11:07 AM, Henry B. Hotz <hotz at jpl.nasa.gov> wrote:
>> I've got a service provider which is (so far) bureaucratically unable to provide me with the cert needed to verify the signature on their authentication requests.  Is there an easy way to tell the IDP to ignore the signature?

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu