Authentication with SAML2 assertion only

[Tom Scavo]

On Tue, Aug 19, 2014 at 10:21 AM, Marek Denis <marek.denis at gmail.com> wrote:
>
> Continuing this thread. I am currently in the middle of writing a
> piece of software for creating a SAML assertion to be consumed by a
> SP.

Given that there are numerous SAML IdP implementations to choose from,
that course of action is not advised.

> Providing I already know what is the SP endpint
> (sp.com/Shibboleth.sso/SAML2/POST) I shall use for sending my saml
> assertion do I actually need any other information from the SP
> Metadata? Why would SP expose it's public key? Is it used for
> validating that SAML request was issued and unchanged somewhere
> between SP and IDP?

Your questions have nothing to do with Shibboleth and are further
indication that you're probably going about this the wrong way. Why
not use one of the thoroughly tested SAML IdP implementations?

Tom