Are SPs without a certificate common?

[Cantor, Scott]

On 3/1/13 12:14 PM, "Tim Larson" <Tim.Larson at ucf.edu> wrote:

>Thanks.  That is the feedback I was looking for.
>
>Isn't there something about not having a certificate that keeps you from
>verifying the authentication request actually came from the real SP?

Unless you're requiring signed requests, the only legitimacy is derived
from the validation of the response endpoint.

-- Scott