Ex: Re: which SP when signature validation fails?

[Paul B. Henson]

On Sun, Jul 09, 2023 at 07:19:20PM +0000, Cantor, Scott wrote:

> It logs the result of every request except for a few cases, and if
> it's not logging enough to flag which transaction is the problem,
> that's the thing you have to adjust.
> 
> If it's not auditing the event at all, that's a bug.

Pretty sure it didn't log anything. Looks like the process log includes
the entity-id for Redirect failures but not POST failures, maybe the
audit log is the same? If so, should I open a second issue?

> If it's a recurring issue, I bypass the key as leaving time bombs in
> the system is usually a bad idea.

If you update the metadata to disable requiring signatures for authn
requests and remove the cert, doesn't it still fail if it gets a signed
authn request? I vaguely remember testing that once. Ah, I see in the
docs you can set the ignoreRequestSignatures option on the profile. Hmm,
I wonder who wrote that documentation ;)....

"If the signer's code is broken, or even worse if they manage their key
poorly and require constant flag days to update them, this allows the
signature to be ignored and potentially the key to be bypassed so their
incompetence doesn't impact your operations."

I'll definitely consider that if they do this again next year. Our ISO
would probably have a conniption if she found out though, generally the
appearance of security/checking boxes is high on her list of must-do's
<sigh>.

Thanks...

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768