signed versus unsigned sp-initiated sso requests

[Paul Hethmon]

On Mar 24, 2014, at 2:08 PM, Tom Scavo <trscavo at internet2.edu<mailto:trscavo at internet2.edu>> wrote:

We have standard shibboleth IdP 2.4.0, and I have not sure how to answer the
question about whether a signed or unsigned sp-iniated sso request is
required. How do I determine what the IdP support or not support? Thanks.

Unless there's some compelling reason to sign the AuthnRequest, you
should send an unsigned request. This is what happens in the
overwhelming majority of cases, so chances are it will Just Work.

And typically I've found when a new SP sends a signed request, they cannot send a correct one. It will never validate.

Given Shibboleth requires the ACS endpoint in the request match one in the SP metadata, signing a request does not gain you anything.

Paul


Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140324/2f7969e7/attachment-0001.html