Authentication with SAML2 assertion only

[Cantor, Scott]

On 8/19/14, 10:21 AM, "Marek Denis" <marek.denis at gmail.com> wrote:
>
>Continuing this thread. I am currently in the middle of writing a
>piece of software for creating a SAML assertion to be consumed by a
>SP. Providing I already know what is the SP endpint
>(sp.com/Shibboleth.sso/SAML2/POST) I shall use for sending my saml
>assertion do I actually need any other information from the SP
>Metadata?

That depends how serious you are about implementing SAML.

> Why would SP expose it's public key? Is it used for
>validating that SAML request was issued and unchanged somewhere
>between SP and IDP?

No, it's for encryption, and for authenticating signatures or TLS
connections made by the SP as part of other bindings and profiles.

As Tom noted, if you have SAML questions, they should go to saml-dev at
OASIS.

-- Scott