Implications of forceAuthn/AuthnInstant

[Cantor, Scott]

On 10/11/13 3:08 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:

>Note that there is also the metadata boolean attribute
>IDPSSODescriptor/@WantAuthnRequestsSigned, which is basically the
>reverse: the IdP telling SP's that they should sign their
>AuthnRequests.  I just double-checked the spec language, I don't see any
>RFC MUST or MUST NOT language around either of these, so I don't know
>how "strong" these metadata requirements are intended to be (Scott?).

Most of metadata content without explicit rules were meant as signals
about expected outcomes.

> 
>But I would think it's reasonable to assume that if an IdP indicates
>that as required via its metadata, an SP could expect an unsigned
>AuthnRequest to be rejected.

That's basically what it means to the peer. How you choose to do something
with the information (such as auto-enabling signing) was not mandated.

>I don't know if the Shib SP actually does anything with this, i.e.
>automatically signs if the IdP's metadata indicates
>WantAuthnRequestsSigned=true.  A simple wiki search for
>WantAuthnRequestsSigned produces no results.  Maybe Scott knows.

It does, provided a key is available. I don't think it errors out if not.

-- Scott