SP 3.4.1 and request signing

[Wessel, Keith]

Hi, all,

I'm working with an SP admin who wants to use skipEndpointValidation on my IdP for a multi-host SP so he doesn't have to register all of the endpoints. But we're having some trouble getting the SP to sign the authn requests. Even with signing="true" added to the <ApplicationDefaults> or <SSO> elements, the auhthn requests being sent (and confirmed with my SAML tracer) are not signed.

I reproduced this in one of my SPs with logging for several classes turned up to debug. I see the unsigned authn request logged, then:

2023-09-16 11:40:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] [default]: signing the message
2023-09-16 11:40:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] [default]: message encoded, sending redirect to client

A signed request never gets logged or sent despite that first log message saying it's signing it. With signing="true" not in the shibboleth2.xml, that first log message doesn't appear. So, the SP is clearly trying to honor my signing="true" setting.

This sounds like a bug, but before I file it, I wanted to make sure I wasn't overlooking some other setting. After all, even though authn request signing isn't widely used, this seems like a bug that wouldn't have slipped through. So, I'm doubting myself here.

Thanks,
Keith