Unnecessary AuthnRequest?

[Tom Scavo]

On Mon, Dec 22, 2014 at 1:13 PM, kripp <kripp at compsych.com> wrote:
> Hello, we are implementing IDP initiated POST SSO with a vendor.  We are the
> SP.  I believe they are also using Shibboleth and they are getting a page
> that says, "Shibboleth Authentication Request".  It is my understanding that
> since we are doing IDP initiated that authentication should be taking place
> prior to the assertion.  We have never had this problem with any other
> vendor.  If you look at the below logs you will see that we are redirecting
> to the RelayState URL and then sending back the "AuthnRequest" which I
> believe is the problem.  What is causing Shibboleth SP to send back this
> tag?  "WantAuthnRequestsSigned" property in the IDP metadata which is set to
> true?  Also please note that I have removed some personal information.

Looks like the problem is on your (the SP) side. After you consume the
assertion from the IdP, you redirect the browser to an endpoint that
issues a signed AuthnRequest!

Tom