Validate InResponseTo attribute

[Cantor, Scott]

On 1/9/19, 11:17 AM, "users on behalf of Paolo Smiraglia" <users-bounces at shibboleth.net on behalf of paolo.smiraglia at gmail.com> wrote:

> So, from your answers I have to assume that with Shibboleth SP there
> is no way to verify the "inResponseTo" attibute. Is it correct?

Not in any practical sense.

> If so, why this feature was not included? Is it because Web Browser
> SSO supports "unsolicited responses" [1, Sec 4.1.5]?

Yes. SAML conformance requires supporting that in an implementation, and having not implemented a feature to block that, it serves no purpose to pay any attention to request machinery.
 
> Have you some alternative strategy to address the "InResponseTo" validation?

An alternative to a yes/no question? It's supported or it's not.

-- Scott