idp v3 - unsolicited sso failing

[Cantor, Scott]

On 3/15/15, 7:40 PM, "Marc Boorshtein" <mboorshtein at gmail.com> wrote:

>OK, so the fact that I thought this was inconsistent between SP and unsolicited was clearly PEBKAC.  I still don't agree with the implementation of unsolicited sso and would request an option to control the behavior but its not critical to what I'm working on and I can find another way to validate that particular use case.

It is "controllable" but not easily. The rule that's enforcing it is inside the security policy "chain" that runs on the messages, and it can be replaced, but we don't really intend it and it's not documented at this point.

If you have a real need temporarily to toggle it off, the rule is inside system/flows/saml/sso-security-flow.xml, just comment out the SAML2AuthnRequestsSignedSecurityHandler line.

To do it in an upgrade-safe way is possible but fairly ugly right now.

Adding a property to toggle it would be a 30 second change, you can file a RFE if you like.

-- Scott