Implications of forceAuthn/AuthnInstant

[Eric Goodman]

>If the SP indicates in its metadata that it signs requests, then this 
>works out-of-the box with no additional work.  They indicate this with 
>the boolean attribute SPSSODescriptor at AuthnRequestsSigned.  FYI, that 
>is what is enforced in the default security policy with id 
>'shibboleth.SAML2SSOSecurityPolicy' by the rule called 
>'samlsec:SAML2AuthnRequestsSigned'.

>That mechanism will work as intended if the SP's metadata expresses that, 
>or can be made to express that.  I guess a case where it might not is if 
>the metadata is being pulled from some central publishing point (e.g. 
>InCommon) and the SP doesn't want to sign AuthnRequests to *all* IdP's 
>and indicate such in its metadata.  

That's great! Thanks. I didn't realize that indicating signing at the SP implicitly requires it at the IdP, so didn't look for SP signing elements. And it makes sense that the SP is what controls it, since in most cases it's the SP operator who really cares.

In my scenario every IdP associated with the SP would be required to sign, so there's no "conditional based on IdP" problem.

>Otherwise, I think that, yes, you could use the 
>"security:MandatoryMessageAuthentication" rule to accomplish this, 
>in a more indirect manner (not enforcing signing literally, but 
>enforcing peer authN where the only mechanism by which that could 
>happen in the SSO flow would be signing).  You'd just copy the 
>'shibboleth.SAML2SSOSecurityPolicy' security policy block, giving 
>it a new id and changing its content as appropriate.  Then for each 
>RP, create a custom RelyingParty with the relevant ProfileConfiguration(s).[1]  
>Each ProfileConfiguration can take a 'securityPolicyRef' attribute which 
>points at a specific non-default security policy id.  For some reason, 
>we don't document this attribute in the wiki, but you can see it in the 
>config XML schema [2], including what the defaults are.

Perfect. Given the previous option I won't use this but I was interested in how the SecurityPolicys mapped to the ProfileConfigurations.

Thanks again!

--- Eric