Unsolicited SSO with AuthnRequestsSigned="true" SP metadata

[Peter Schober]

* Santu Ghosh <mon.snahasish at gmail.com> [2017-11-28 19:20]:
> To clarify my understanding from the discussions is that there are
> *ONLY 2* possible
> solutions for the mentioned problem.
> 
> 1) If I want to proceed with unsolicited SSO, I *HAVE TO* remove
> WantAssertionsSigned="true"
> from my SP metadata file *EACH AND EVERY* time before reloading it in IDP.
> 2) I can proceed with SP initiated flow, then no modification require in SP
> metadata.

If the current SP metadata prevents legitimate use on your side (not
that you've explained why IDP-initiated must be used, so far) you can
also just ask the source of the metadata to remove that XML attribute.

Also note that if you're loading SAML metadata from the SP directly
over http (or https) you're opening up your IDP for all kinds of
security issues. AuthnRequestsSigned being set on that one SP is the
least of your issues then.

-peter