Implications of forceAuthn/AuthnInstant

[Brent Putman]

On 10/11/13 11:40 AM, Eric Goodman wrote:
>> If the SP indicates in its metadata that it signs requests, then this 
>> works out-of-the box with no additional work.  They indicate this with 
>> the boolean attribute SPSSODescriptor at AuthnRequestsSigned. 
>
> That's great! Thanks. I didn't realize that indicating signing at the SP implicitly requires it at the IdP, so didn't look for SP signing elements. And it makes sense that the SP is what controls it, since in most cases it's the SP operator who really cares.

Note that there is also the metadata boolean attribute
IDPSSODescriptor/@WantAuthnRequestsSigned, which is basically the
reverse: the IdP telling SP's that they should sign their
AuthnRequests.  I just double-checked the spec language, I don't see any
RFC MUST or MUST NOT language around either of these, so I don't know
how "strong" these metadata requirements are intended to be (Scott?). 
But I would think it's reasonable to assume that if an IdP indicates
that as required via its metadata, an SP could expect an unsigned
AuthnRequest to be rejected.

I don't know if the Shib SP actually does anything with this, i.e.
automatically signs if the IdP's metadata indicates
WantAuthnRequestsSigned=true.  A simple wiki search for
WantAuthnRequestsSigned produces no results.  Maybe Scott knows.