Error after succeeded authentication

[Peter Schober]

* Ortner Nikolaus <N.Ortner at fh-kaernten.at> [2013-07-10 09:21]:
> Well, yes. I was just wondering why http should be "preferred". In
> my IdP-world you'll sooner or later end up relying on https - when
> having a SP with unsigned metadata or when downloading a signature
> certificate. [but maybe I'm missing some point]

One of the points is that unless you use the only recently documented
method of specifying options to libcurl regarding TLS, fetching
unsigned metadata via https will not give you any real benefit or
improvement over http (contrary to what you might think, from what you
state above).
While confidentiality might still be there (which is irrelevant in the
case of published metadata) the desired /authenticity/ of the
endpoint is not evaluated by default. I.e., anyone could manipulte
your local resolver, redirect requests to a different server serving
up different (unsigned) metadata and the mismatch from server name and
X.509 subject in the TLS/SSL certificate will not be objected to.

So fetching unsigned metadata via https (without going the extra mile
and specifying curl transport options) seems to be little more than a
more expensive (computationally) but no more secure way to establish
technical trust in SAML entities, compared to fetching via http.

Bootstrapping trust in a signing key also shouldn't rely solely on the
public key being hosted on a server with a valid TLS/SSL certificate,
but that's a different topic with different remedies. (Short version:
You do that once OOB and there are many ways to ensure authenticity.)
-peter