idp v3 - unsolicited sso failing

[Eric Goodman]

> I still don't agree with the implementation of
> unsolicited sso and would request an option to control the behavior but its
> not critical to what I'm working on and I can find another way to validate that
> particular use case.

Just chiming in to agree with Scott here.

The question comes down to what the point of requiring signed authentication requests is in the first place. The only reason to have signed authentication requests is to allow you to verify the source of the request. IdP-initiated SSO requests can't have their source verified. Allowing unsolicited authentication when signing is required just seems nonsensical.

If you don't care how an authentication request was initiated, then you shouldn't be requiring request signing. 

What's the use case (other than broken implementations) where it's relevant to require signing of authentication requests but it's okay to initiate IdP SSO from completely unknown sources?

--- Eric