Shibboleth IDP version 4.1.2 not honoring wantAuthnRequestsSigned Flag

[Peter Schober]

* Kumar, Prasanth (ELS-LON) <p.kumar.13 at elsevier.com> [2021-07-09 11:06]:
> When shibboleth service provider sends an non-signed authn requests
> then identify provider should be rejecting the request in this case.

Is there anything worth protecting in the authentication request --
what specifically?
Otherwise don't do that (any of it: don't sign them, don't change
metadata about signed authn requests).

> On metadata this flag set to false -  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"  WantAuthnRequestsSigned="false">

Which should be the same thing as not specifying it.

> Following https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration configuration changes on IDP side doesn't seems to working:
> idp.saml.honorWantAuthnRequestsSigned=true in idp.properties file

The last paragraph on that page seems to be specific about proxying
(i.e., when your IDP *also* acts as an SP)?

> Do I have to enable the flag in <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false">

Yes, If that SP always signs its authn requests you'd want to set this
to true so that the IDP can tell an unsigned request deviates from
what the metadata said would happen.

-peter