<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On Mar 24, 2014, at 2:08 PM, Tom Scavo <<a href="mailto:trscavo@internet2.edu">trscavo@internet2.edu</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
We have standard shibboleth IdP 2.4.0, and I have not sure how to answer the<br>
question about whether a signed or unsigned sp-iniated sso request is<br>
required. How do I determine what the IdP support or not support? Thanks.<br>
</blockquote>
<br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Unless
there's some compelling reason to sign the AuthnRequest, you</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">should
send an unsigned request. This is what happens in the</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">overwhelming
majority of cases, so chances are it will Just Work.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</blockquote>
</div>
<div><br>
</div>
<div>And typically I've found when a new SP sends a signed request, they cannot send a correct one. It will never validate.</div>
<div><br>
</div>
<div>Given Shibboleth requires the ACS endpoint in the request match one in the SP metadata, signing a request does not gain you anything.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<br>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</body>
</html>