Unsolicited SSO with no entity ID or metadata

[Cantor, Scott]

On 1/11/16, 10:31 AM, "users on behalf of Ben Branch" <users-bounces at shibboleth.net on behalf of BBranch at uco.edu> wrote:



>You were absolutely correct about the SAML end point being the Entity ID for this SP.  I created the Metadata by hand and used their end point as the entityId value and everything worked like a champ.  Many thanks for your assistance!

That may also just mean they don't even check it. You may want to check that, because that introduces the possibility they have security bugs.

-- Scott

>