How to check Issuer existence in idp Response

[Cantor, Scott]

On 7/5/22, 9:47 AM, "users on behalf of Michele Innocenti" <users-bounces at shibboleth.net on behalf of michele at etruriapa.it> wrote:

>    I should check issuer out of Assertion but I can't because it is expected to be optional.

Yes, but if it were absent, the IdP name in the usual place would reflect the issuer from the response. That's my point, that is the issuer and it's one or the other or both, and they have to match.

>    The problem arises from having non-standard specifications (spid vs saml2).

Yes, it does. It's one thing to produce profiles that simplify requirements, but it's another to expect software to impose them.

-- Scott