unsigned authN requests

[Cantor, Scott]

On 6/5/13 7:04 PM, "David Bantz" <dabantz at alaska.edu> wrote:

>I have a vendor that is currently sending unsigned authN requests [having
>persuaded them to remove an errant X.509 certificate embedded in the
>request].  My IdP objects that the unsigned request does not meet
>security requirements (refusing to process it).  As this is a service
>providing electronic signatures for work flow and approval documents, it
>has seemed to me reasonable and prudent to ask that they digitally sign
>the authN request to our IdP.

I don't think that follows, but there's no way the request could be
unsigned if you're getting that error. That means it's signed and not
verifiable (or something else is wrong with it).

>* Am I off base in asking for signed authN request?  Isn't that usual?

No, it's extremely unusual.

>* If they are unable or unwilling [sic!] to sign the SAML authN request,
>I presume I can configure my IdP to permit unsigned requests from them,
>but I haven't discovered the documentation for doing so.

You don't have to do anything, that's why I know it's not unsigned now.

>* Do you have a suggested strategy/rationale to persuade my vendors to
>sign requests?

What is it you intend to accomplish by doing so? None of your other SPs is
likely doing that.

>* Is this snippet from the "do not edit" portion of the distribution of
>relying-party.xml where the default requirement is set?

That's how verification is controlled, yes.

-- Scott