unsigned authN requests

[Nate Klingenstein]

They wrote their own SAML 2.0 implementation, for what it's worth, and they use it with many customers already.  I have no idea whether they already had code to sign AuthnRequests implemented and working, so it's not a bad question to ask them.

On Jun 6, 2013, at 0:17 , Cantor, Scott wrote:

If it's a key/sig problem, it's tougher, because the key's not in the
message. The only thing you can do is say that it's invalid, and then it's
on them to debug it. It could be that their code is simply broken unless
they have evidence it works with another known correct implementation.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/b50c0754/attachment.html