Shibboleth IdP v3 + Require signed Authnrequests

[Cantor, Scott]

On 6/30/15, 3:22 PM, "users on behalf of keijo.korte at kvak.net" <users-bounces at shibboleth.net on behalf of keijo.korte at kvak.net> wrote:

>We have forced signed requests with this kind of configuration. Of
>course there is a drawbacks (unsolicited), but it works.

I don't understand how it "works" if it's trivially circumvented, so I'm still not getting the point.

>Added below lines to the "<security:SecurityPolicy 
>id="shibboleth.SAML2SSOSecurityPolicy .." block in relying-party.xml:

The only line relevant there should be this one:

><security:Rule xsi:type="security:MandatoryMessageAuthentication"/>

But that's what I figured you meant.

That's the only way to do it now, yes. There is no documentation on it. It involves modifying system files or creating a copy of the existing files and understanding a lot of low level details. I believe I ran through a similar explanation when ScottK asked about turning *off* authentication for Logout, so it's in the archives. I could add a property similarly to the one I did for that use case to toggle on a requirement to sign the requests.

>We are creating a proxy implementation and basically want to make sure 
>that we don't process unsigned requests. All of our requests are 
>initialized at SP, so thats why I am not so worried about unsolicited 
>requests.

That isn't true. You don't control where requests are initiated when you support unsolicited requests.

-- Scott