Nate,<br><br>Thanks a lot for you answers. For some reasons, we have to support http for some SP at the beginning, but we will suggest our user to support https ASAP.<br><br>Just to double check, are you saying that in the metadata we can list something like:<br>
<br><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://localhost/SSO/SAML/ACS/Post">http://localhost/SSO/SAML/ACS/Post</a>" index="0"/><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https:/localhost/SSO/SAML/ACS/Post" index="1"/><br><br>And in each individual AuthnRequest,SP can decide which one to include in the request, and expect the IdP to respond to it, right?<br>
<br>Thanks,<br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Tue, Mar 26, 2013 at 2:13 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>I should probably strengthen this language. Specifically, user authentication is often done via password. In this case, you're not just concerned with an attacker being able to take over a bearer token or a session; it's something more persistent and
less tied to an instance, and it can generally be played by the attacker to the IdP at any time.</div><div class="im">
<br>
<div>
<div>On Mar 26, 2013, at 21:07 , Nate Klingenstein wrote:</div>
<br>
<blockquote type="cite"><span style="border-collapse:separate;font-family:Helvetica;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium">Similarly,
I would recommend that the IdP listen only over TLS. If your metadata reflects this, then users should never be showing up at your IdP on port 80 anyway. Whether or not to redirect users that arrive on port 80 for some reason to 443 is up to your discretion.</span></blockquote>
</div>
<br>
</div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>