idp v3 - unsolicited sso failing

[Marc Boorshtein]

>
>
> > Also you aren't circumventing signing the authn request you are kicking
> off authentication directly from the idp so its not exactly the same thing.
>
> You cannot kick off authentication from the IdP, you can only do it from a
> client. If that request is unsigned, then we aren't requiring signed
> requests ergo the feature isn't being honored. Security settings you can
> circumvent that easily really are broken.
>
>
First off I disagree with the premise that it is some how less secure using
unsolicited (or idp initiated using the more common phrase in government
and private industry) sso if authnrequests need to be signed.  The only
security benefit to signing an authnrequest is to validate any of the input
from the request that can over-ride the metadata or have the idp make
decisions (ie changing the assertionconsumerservice url, choosing a nameid,
etc).  Otherwise an authnrequest is just a link that says "authenticate the
user  for a particular service provider" in which case a digitial signature
would be no more beneficial from a security standpoint then a link to
shibboleth.net.  Since an unsolicited/idp initiated sso shouldn't allow you
to override whats in the metadata requiring a signature from the originator
doesn't provide any security benefit.

Second, in this case this is a purely academic discussion because SP
initiated SSO doesn't sign the authnrequest and it completes just fine.  So
either there's a bug that is allowing an authnrequest to not be signed or
there's a bug where the unsolicited SSO is being too restrictive regardless
of settings.

Thanks
Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150315/859c63c0/attachment-0001.html