AuthnRequestsSigned="true"

[Tom Poage]

> On Feb 10, 2017, at 1:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 2/10/17, 4:02 PM, "users on behalf of Tom Poage" <users-bounces at shibboleth.net on behalf of tfpoage at ucdavis.edu> wrote:
> 
>> The AuthnRequest ended up not containing a signature, but the IdP went ahead and sent an Assertion with complete
>> Subject and AttributeStatement.
> 
> If it did, then the request was in fact signed, and you're probably confused about the fact that signed redirects don't show up as a signature inside the message, and you're looking at the log trace.

Of course. There it is:

GET

SAMLRequest:fVNtb9owEP7eX4HynThJoRQLkCjsBYlBBNmk7cvk2EexlNiZfaZ0v37OS1s6bViyIp2fe+7ueS4Ty8qionOHR7WDXw4s3vT8OZeFsrR5nAbOKKqZlZYqVoKlyOl+/mVNkzCildGouS6Cv9KuZzFrwaDUqk1bLafBdvNhvf202vxkMLzLB+PbRMRRPsjvxgmwwf3ono8YRIM4F0MWD3Met6nfwFjPMw08bRtJjT5JAWbjq06D7+63661Zbnvpw6KrZq2DlbLIFPq8KB71o6QfR1kS0WRMb+MfLW7pxZCKYUN/RKwsJcQeZZ7rAvAYOi7YSdoQhCNSVMRLcZAFkHrKhOxASAMcyX6/fW2skepBKiHV43WF8hZk6ecsS/vpdp+1JPMX5RZaWVeC2YM5SQ5fd+uLJtGJ54o9gg25Lom/le8YSG0M6XgQjcwdQsvjS3VEKyXgPA3iYNbgJnUObSQzs/e8jc/UVhNyiXnLqmhtwWqZ6kLy5yZen4/alAz/P30cxk1Eiv6hgVKnbAVcHiSI4JVmXhT6aWGAoXcZjYOgR94V79YZRLPcfkyEM/YWXgtmpK09hTPj2M35NuslfFH4Td3BYXZ1mTnlNc6HU/950kbUVnvvQWSG+ea1wU6kf5K3XZMrbc9uXp4v/9TZHw==

Signature:L9KLMWDBs591GFLM9oxILe6wA6R2mFU9E20Uw62OOB6IZEr2Enlv8YTUH2J4vCQcBppPdk8rInJOiA6lTWbt6xtRFgRU0jAf6rHW6LDlgW6Y5rZb9290zqnHap3BKBB8kxZly0vrbsq9jtWMdilg8CNvEdO1HmujgNBjnizJjdjwDM6rEkkUIrYlyAMAs+3k9mpBKSEkMjFtBXE9lQXckU+NBvJh82vd96TmIFc/3Lfgqg3p/zkQhbzMOetlPmlMUojOySnQ9HyeEqM9Hl6ypGQGqdba1jIhmlUEkJ0SuMFwLVTz3rijp7aGcgpKaF7BM9jTUS09lWMPA/0vmYob8g==

RelayState: ucdavis_sso_prod

SigAlg: http://www.w3.org/2000/09/xmldsig#rsa-sha1

Thanks. Learned something.
Tom.