question about IdP initiated SSO

[Cantor, Scott]

On 7/26/13 1:09 PM, "Joy Veronneau" <jv11 at cornell.edu> wrote:

>I am working on configuring our IdP (v 2.3.3) with Skillsoft. We want to
>use IdP initiated SSO, and we also use IdP initiated SSO for some other
>vendors (WebEx and WorkDay among them.)
>
>My question centers around using
>AuthnRequestsSigned="true"

You can't tell the IdP that the requests wll be signed, and then use a
profile that doesn't involve signed requests. It's a quirk of
implementation, I believe, because the unsolicited SSO endpoint is
implemented by internally mocking up a SAML request. So I think telling it
that signing will be expected will break any use of the unsolicited
endpoint with that entityID parameter.

>Is there a way to configure IdP initiated SSO for
>AuthnRequestsSigned="true" without breaking our other IdP initiated SSO
>implementations?

You cannot configure it period. It should not break any other SPs, since
the flag is in the one SP's metadata, but it will never work with that SP.

-- Scott