Implications of forceAuthn/AuthnInstant

[Eric Goodman]

At the risk of more dead-horse beating:

>I would note though that using ForceAuthn has generally been associated 
>with using signed requests (and by extension not allowing unsigned 
>requests).

Is the implication of this statement that the following two scenarios are equivalent (from a security point of view)?

Scenario A
1) SP sends ForceAuthn in AuthnRequests
2) SP enforces maxTimeSinceAuthn on incoming assertions


Scenario B
1) SP sends ForceAuthn in AuthnRequests
2) SP AuthnRequest are signed
3) SP operator ensures that any relied upon IdPs honor and support ForceAuthn 
4) SP operator ensures that any relied upon IdPs require signed AuthnRequests from this SP


I grant that in scenario A there's still an implicit requirement that for logins to work the SP operator must ensure all IdPs honor the ForceAuthn, there's just less security risk in scenario A's failure mode if that is not done.


Thanks,

--- Eric