Unsolicited SSO with AuthnRequestsSigned="true" SP metadata

[Santu Ghosh]

Hi Peter,

By policy, we will use only IDP initiated flow. In that case I have to
remove the XML attribute from SP metadata (as only solution).

Snahasish

On Tue, Nov 28, 2017 at 11:58 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Santu Ghosh <mon.snahasish at gmail.com> [2017-11-28 19:20]:
> > To clarify my understanding from the discussions is that there are
> > *ONLY 2* possible
> > solutions for the mentioned problem.
> >
> > 1) If I want to proceed with unsolicited SSO, I *HAVE TO* remove
> > WantAssertionsSigned="true"
> > from my SP metadata file *EACH AND EVERY* time before reloading it in
> IDP.
> > 2) I can proceed with SP initiated flow, then no modification require in
> SP
> > metadata.
>
> If the current SP metadata prevents legitimate use on your side (not
> that you've explained why IDP-initiated must be used, so far) you can
> also just ask the source of the metadata to remove that XML attribute.
>
> Also note that if you're loading SAML metadata from the SP directly
> over http (or https) you're opening up your IDP for all kinds of
> security issues. AuthnRequestsSigned being set on that one SP is the
> least of your issues then.
>
> -peter
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171129/11201fe4/attachment.html>