Shibboleth IdP v3 + Require signed Authnrequests

[keijo.korte at kvak.net]

> I'm not sure I recall any way to do that for 2.x, actually. I was going 
> to say the \
> answer was no, but if there was a way to do it before there probably is 
> now. I can't \
> think of any way off the top of my head except by manipulating security 
> policy \
> handlers, so I doubt there's any simple way now.

We have forced signed requests with this kind of configuration. Of 
course there is a drawbacks (unsolicited), but it works.

Added below lines to the "<security:SecurityPolicy 
id="shibboleth.SAML2SSOSecurityPolicy .." block in relying-party.xml:

<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" 
trustEngineRef="shibboleth.SignatureTrustEngine"/>

> As I have covered several times, and though some disagree, my opinion 
> is that you \
> cannot do this while still supporting unsolicted responses either.

> Why do you think you need to do this in the first place?

We are creating a proxy implementation and basically want to make sure 
that we don't process unsigned requests. All of our requests are 
initialized at SP, so thats why I am not so worried about unsolicited 
requests.

There are "many" guys that handles our metadata. Services comes and 
goes, and I am pretty sure that at some point someone forgets that  
wantauthnrequestssigned. So basically the "last line of defence". 
Probably little bit of paranoid, but if there is a way to require signed 
requests then I would like to put that on.

If there isn't a way, then we just rely that the metadata is OK.

> -- Scott

-Keijo