<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 3/20/14 10:23 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:CF5071BB.A42E%25cantor.2@osu.edu" type="cite">
<pre wrap="">On 3/20/14, 8:03 AM, "Vasu Y" <a class="moz-txt-link-rfc2396E" href="mailto:vyal2k@yahoo.com"><vyal2k@yahoo.com></a> wrote:
</pre>
<br>
<pre wrap="">
I don't think the IdP omits the Destination check based on whether the
message was signed (though it's of no value in unsigned cases), but
regardless, you are failing to follow the standard and not setting a
Destination attribute.
</pre>
</blockquote>
<br>
Well, that's literally true, the IdP doesn't *omit* the check based
on signing or not. Actually, however, it does change its behavior
based on whether the message is signed, per the SAML spec. If the
message is signed, the Destination attribute is required and checked
against the delivered endpoint. If the message is not signed then:
1) if Destination is there it's evaluated (and can fail if doesn't
match the delivered endpoint) 2) if the Destination is not there,
it's not an error, the eval is just skipped.<br>
<br>
<br>
</body>
</html>