<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Feb 4, 2015 at 4:48 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">> As far as I can tell, SAML2 says that the "Issuer" is only mandatory inside the<br>
> assertion element (inside the response, it's optional), and as that's what we<br>
> need to be able to trust, surely it's the assertion that it's important be<br>
> signed?<br>
<br>
</span>The assertion has to be protected, which can be done a number of different ways. Issuer is only optional in a response if it's not signed.<br></blockquote><div> </div></div>saml-core-2.0-os-4.pdf, line 1566:<br> <saml:Issuer> [Optional]<br> Identifies the entity that generated the response message. (For more information on this element, see<br> Section 2.2.5.)<br><br>I don't see anything in the above spec about it ever being a non-optional element.<br><br></div><div class="gmail_extra">Best regards,<br>Jeremy Morton (Jez)<br></div></div>