idp v3 - unsolicited sso failing

[Cantor, Scott]

On 3/17/15, 10:08 PM, "Marc Boorshtein" <mboorshtein at gmail.com> wrote:
>
>How does not having a signature for unsolicited sso (aka IdP Initiated SSO) hurt from a security perspective? 

It is a bug to not honor it that is tangentially a security issue, if you consider things like auditing or billing requirements to be security related. Some people do. That was the genesis of requiring signing via metadata.

> All you are doing is verifying the source of the link.  If you go to
>my.bad.site.com <http://my.bad.site.com> and I have a backchannel request (say an iframe or an ajax request) that starts the SSO process in the background (assuming of course the browser allows it, which in most cases it wont) what is the difference between that initial URL being for the SP that then sends a redirect to the idp with a signed request?

Not every SP issues requests in a completely arbitrary, unauthenticated way though. Most do, of course, but most don't get into this signing stuff either.

-- Scott