SAML security question

[Peter Spiro]

Hello SAML mavens,

I have a SAML security question.

We're a SP supporting IdP-initiated SSO.  We have an IdP who would like to send signed SAML responses but convey the user-identifying data as additional https POST parameters rather than including this information within the signed message.

The IdP feels this would be secure.  To me it seems inherently insecure because the identifying information wouldn't be signed, but I'm hard-pressed to imagine a scenario where an attacker could take advantage of it.

Can anyone tell me whether this would be secure, and why?  Any informed opinions would be greatly appreciated!

(Apologies if this question isn't appropriate for this forum, in which case I'd appreciate recommendations for where to post it.)

Thanks,
Peter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130411/06fefa83/attachment-0001.html