idp v3 - unsolicited sso failing

[Cantor, Scott]

On 3/17/15, 7:52 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>
>The question comes down to what the point of requiring signed authentication requests is in the first place. The only reason to have signed authentication requests is to allow you to verify the source of the request. IdP-initiated SSO requests can't have their source verified. Allowing unsolicited authentication when signing is required just seems nonsensical.

Well, there are really two use cases involved. One is what the OP mentioned, allowing the IdP to override certain assumptions from metadata. That use case doesn't get compromised by allowing unsigned requests because you just don't authorize the IdP to override things in that case.

But the other use case is basically to allow the SP to require the IdP to only respond to a signed request, whether for auditing, or because the IdP is charging per request, or whatever. That is what the metadata flag was designed for, so that's the reason why I don't believe it can be allowed to be bypassed.

If you want the first use case, you just don't set the metadata flag.

-- Scott