Signing authN requests: yea or nay?

[Cantor, Scott]

On 9/24/13 1:34 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote:
>
>Because the IdP will only send back a response to the "right place" for an
>SP (i.e. the meta-data-registered ACS endpoint), it doesn't really matter
>if  the IdP can't verify that the request actually came from the SP.
>That is, only an authorized entity will get a response even if an
>unauthorized entity made the request.

If you configure it that way (which is the default), yes, but "delivery"
is up to the client, not the IdP. An attacker can always get a response if
it can authenticate to the IdP, which means it really depends what kind of
attacker you're talking about.

The purpose of signing requests in the original specification process was
auditing, not an attack mitigation.

-- Scott