How to check Issuer existence in idp Response

[Brent Putman]

On 7/1/22 3:44 PM, Cantor, Scott via users wrote:
> I don't know what you're asking or trying to do, but the SP enforces the profile requirement that the Assertion's issuer must match the Response issuer. They can't be different by definition for the only profile supported.


In the OP's 2 examples, I believe the delta is that in the first, the 
Response Issuer is omitted entirely.  I had to check the SSO profile 
spec to confirm, apparently that's allowed: "The (<Response>) <Issuer> 
element MAY be omitted, but if present must contain...".

So I guess what the OP asking is if there's a way to enforce the 
presence.  Since the spec allows it explicitly to be omitted, I'm not 
sure what the reason is.  And I doubt the SP supports arbitrary 
validation rules like that anyway, right?

If the Response Issuer is omitted, one can always just use the 
Assertion(s) Issuer value, since they all have to be the same anyway, 
per the spec.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220701/74b479c8/attachment.htm>