"Rejecting replayed message ID" for iOS Native Application when using webview element

[Nate Klingenstein]

> Unless the AuthnRequest is signed, there really is no security-related information in the AuthnRequest and the unique message ID is mostly to catch users who like that back button and would trap themselves in a loop or other error condition otherwise.  It is possible to turn off the rule that checks for duplicates in production using configuration, but know that the GUI impact would be significant.  I'd only use this as a last resort if nobody else has a better idea.

Actually, excuse me.  This is about the ID of the assertion, which is disconnected from the ID of any AuthnRequest, and yes, it does have some real security relevance.  It means that a stolen assertion would be usable for 8 minutes to create a session, whereas with this rule in place, you have to beat the legitimate user to the site.  So yes, I'd consider it a last resort.

I'm sorry for the confusion.