/SAML2/POST-SimpleSign

[Brent Putman]

On 2/13/17 3:15 PM, Klingenstein, Nate wrote:
>
> There is no signature anyway,
>

Technically, in that binding the "SimpleSign" signature is not
mandatory, nor is an XML signature disallowed.  In other words, it
could look identical to a standard POST binding. So that's not
significant.  However...

> so I’ll be chatting with the vendor,
>

But more importantly: Looks like they're actually doing HTTP-Redirect,
based on the use of query params.  So probably this is just messed up
metadata or configuration somewhere. 


> but for grins, was Simple-Sign ever implemented for authentication
> requests?
>

Yes, absolutely.  You'll see the flow itself defined in
system/conf/webflow-config.xml, and the supporting flow files as
system/flows/saml/saml2/sso-post-simplesign-{beans,flow}.xml (although
most of the real guts of the flow are defined in other files from which
those inherit). 

But POST SimpleSign only supports HTTP POST method and they're doing a
GET, so that's probably why it's erroring out.  It's just a mismatch of
binding and recipient endpoint.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170213/a0f43885/attachment-0001.html>