idp v3 - unsolicited sso failing

[Cantor, Scott]

On 3/15/15, 4:32 PM, "Marc Boorshtein" <mboorshtein at gmail.com> wrote:
>
>First off I disagree with the premise that it is some how less secure using unsolicited (or idp initiated using the more common phrase in government and private industry) sso if authnrequests need to be signed.

You can disagree if you like.

>Since an unsolicited/idp initiated sso shouldn't allow you to override whats in the metadata requiring a signature from the originator doesn't provide any security benefit.

That essentially argues that the metadata flag has no value, which is perfectly fine, but it's a separate question from what to do if it's set.

>Second, in this case this is a purely academic discussion because SP initiated SSO doesn't sign the authnrequest and it completes just fine.  So either there's a bug that is allowing an authnrequest to not signed or there's a bug where the unsolicited SSO is being too restrictive regardless of settings.

I have tested the setting and verified the behavior, and I guess I can test it again.

-- Scott