Shibboleth IDP Connected to OIOSAML.net dk.nita.saml20 Service Provider

[Paul Hethmon]

On Aug 1, 2014, at 6:50 PM, Andrew A. DeVries <adevries at digitalexample.com<mailto:adevries at digitalexample.com>> wrote:

Am I correct in that the public key used to validate the signature is included in the returned assertion?

Many IdP implementations do return it in the Response, but you should never trust it because its in the response. If you do, you are trusting random data being sent to you. You have to establish that trust out of band.

Paul

Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140802/66af3ee1/attachment.html