unsigned authN requests

[Brent Putman]

On 6/5/13 7:40 PM, Cantor, Scott wrote:
> On 6/5/13 7:04 PM, "David Bantz" <dabantz at alaska.edu> wrote:
>
>>  My IdP objects that the unsigned request does not meet
>> security requirements (refusing to process it). 
> I don't think that follows, but there's no way the request could be
> unsigned if you're getting that error. That means it's signed and not
> verifiable (or something else is wrong with it).

It sounds like this isn't the problem, but just wanted to comment that: Actually, you can get an
unsigned SAML 2 AuthnRequest that fails the IdP's security policy (just b/c it's unsigned) if the
SP's metadata says that it will sign requests.  That's what this security rule does:

<security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>


I doubt anyone uses that much, but that's what it does, enforce the
SPSSODescriptor/@AuthnRequestsSigned metadata attribute semantics.

--Brent