Forced Authn and IdPUnsolicitedSSO

[Eric Goodman]

>I think the SP is responsible for enforcing any check regardless, and most of
>the data available to it comes from the IdP.

Absolutely, it's a basic point, but not necessarily obvious. I was just calling out the need to check in case it wasn't obvious to the OP, especially given that he can't have the SP sign the request in this case (IdP-initiated requests only).


>In both these cases, you're relying on the IdP to accurately represent what has occurred,
>no matter what "what" is, and you don't really have a good way of validating that beyond
>trusting that specific IdP.

Yeah, the rest of my post was largely whining about the difficulty of validating via the assertion that a user authn interaction actually occurred in the real world. :)

--- Eric


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140805/50916a92/attachment-0001.html