Signing authN requests: yea or nay?

[Cantor, Scott]

On 9/23/13 6:51 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote:
>
>Sure, we could encrypt the response  and let that serve as a guard against
>unwarranted parties reading the assertion but I'm kind of against
>solutions that are open to off-line attack even if one could say "who
>would bother?"

Requiring signed requests won't help with that. Getting a signed request
does not require proving anything to anybody, it's something an SP will
simply do on demand. At least in my implementation; there are some that
wouldn't do that.

The main advantage of signed requests from a Shibboleth SP is to allow for
bypassing ACS checking at the IdP, which I implemented in V2.4. For that
purpose, it has definite advantages on a case by case basis, but that's
not the same as requiring it from all SPs.

-- Scott