<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br>
<span class=""><br>
>Since an unsolicited/idp initiated sso shouldn't allow you to override whats in the metadata requiring a signature from the originator doesn't provide any security benefit.<br>
<br>
</span>That essentially argues that the metadata flag has no value, which is perfectly fine, but it's a separate question from what to do if it's set.<br>
<br></blockquote><div><br></div><div>No, I'm saying the metadata flag from wanting authnrequests signed is not applicable to unsolicited sso because unsolicited sso is not the same thing as an authnrequest thats part of an sp initiated sso.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
>Second, in this case this is a purely academic discussion because SP initiated SSO doesn't sign the authnrequest and it completes just fine. So either there's a bug that is allowing an authnrequest to not signed or there's a bug where the unsolicited SSO is being too restrictive regardless of settings.<br>
<br>
I have tested the setting and verified the behavior, and I guess I can test it again.<br>
<div class=""><div class="h5"><br></div></div></blockquote><div>OK, but this is a verifiable and repeatable issue. This is how I got these results:</div><div><br></div><div>1. Took an existing shib 3 idp</div><div>2. Changed the <span class="">idp.</span><span class="">entity</span><span class="">ID in idp.properties</span></div><div><span class="">3. Replaced the metadata for my SP to include :</span></div><div><span class=""><br></span></div><div><span class="">
<p class=""><span class=""><</span><span class="">md</span><span class="">:</span><span class="">EntityDescriptor </span><span class="">xmlns</span><span class="">:</span><span class="">md</span><span class="">=</span><span class="">"urn:oasis:names:tc:SAML:2.0:metadata"</span></p>
<p class=""><span class=""> </span><span class="">ID</span><span class="">=</span><span class="">"fbf6521d9dbbdd0ae14a2bb1a3c642876e86a3435"</span><span class=""> </span><span class="">entity</span><span class="">ID</span><span class="">=</span><span class="">"<a href="http://spenc.autoidm.com:9090/auth/SAML2Auth">http://spenc.autoidm.com:9090/auth/SAML2Auth</a>"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">SPSSODescriptor </span><span class="">AuthnRequestsSigned</span><span class="">=</span><span class="">"true"</span></p>
<p class=""><span class=""> </span><span class="">WantAssertionsSigned</span><span class="">=</span><span class="">"true"</span><span class=""> </span><span class="">protocolSupportEnumeration</span><span class="">=</span><span class="">"urn:oasis:names:tc:SAML:2.0:protocol"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">KeyDescriptor </span><span class="">use</span><span class="">=</span><span class="">"encryption"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">KeyInfo </span><span class="">xmlns</span><span class="">:</span><span class="">ds</span><span class="">=</span><span class="">"<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">X509Data></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">X509Certificate></span></p>
<p class=""><span class=""> MIICOzCCAaSgAwIBAgIETmvMNTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJ1czENMAsGA1UE</span></p>
<p class=""><span class="">CBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDENMAsGA1UECxMEdGVzdDEXMBUG</span></p>
<p class=""><span class="">A1UEAxMOdHJlbW9sby1zcC1lbmMwHhcNMTEwOTEwMjA0NDM3WhcNMTExMjA5MjA0NDM3WjBiMQsw</span></p>
<p class=""><span class="">CQYDVQQGEwJ1czENMAsGA1UECBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDEN</span></p>
<p class=""><span class="">MAsGA1UECxMEdGVzdDEXMBUGA1UEAxMOdHJlbW9sby1zcC1lbmMwgZ8wDQYJKoZIhvcNAQEBBQAD</span></p>
<p class=""><span class="">gY0AMIGJAoGBAMCPvwDY8F9d0ftJ7NfNUx1KR+ZJeOiFn+P/0gj8REjuHiFITr2qjpYvSZDItj/d</span></p>
<p class=""><span class="">F79ggZTIUYBX02Nl+xqBBbZGYsJFdkyzq4kGbuxaCXagCXpyz6uOfOLQ5GjB/YKbMwcTtTZLUPSM</span></p>
<p class=""><span class="">X8CczyWtuinGMzTz524wPZLMO6ahtlaxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAaJhCLZ9UVx4v</span></p>
<p class=""><span class="">iIvECXB9HbHJMOEzZw37c0+xJ2NbOfGEYTlyZuSHfUOigBDUP9dSHoWKTLdNcWZ4CkcS66M4ROG8</span></p>
<p class=""><span class="">ZHdDJFMo3WVtfbjFMSSMKPc4Qh2wS+qS51cxfiZTrv8AfFxJcxoyef0OxO9BpND4t0BrYw6HXyNj</span></p>
<p class=""><span class="">W1nmaX8=</span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">X509Certificate></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">X509Data></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">KeyInfo></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">md</span><span class="">:</span><span class="">KeyDescriptor></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">KeyDescriptor </span><span class="">use</span><span class="">=</span><span class="">"signing"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">KeyInfo </span><span class="">xmlns</span><span class="">:</span><span class="">ds</span><span class="">=</span><span class="">"<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"</span><span class="">></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">X509Data></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">ds</span><span class="">:</span><span class="">X509Certificate></span></p>
<p class=""><span class=""> MIICOzCCAaSgAwIBAgIETmvMNTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJ1czENMAsGA1UE</span></p>
<p class=""><span class="">CBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDENMAsGA1UECxMEdGVzdDEXMBUG</span></p>
<p class=""><span class="">A1UEAxMOdHJlbW9sby1zcC1lbmMwHhcNMTEwOTEwMjA0NDM3WhcNMTExMjA5MjA0NDM3WjBiMQsw</span></p>
<p class=""><span class="">CQYDVQQGEwJ1czENMAsGA1UECBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDEN</span></p>
<p class=""><span class="">MAsGA1UECxMEdGVzdDEXMBUGA1UEAxMOdHJlbW9sby1zcC1lbmMwgZ8wDQYJKoZIhvcNAQEBBQAD</span></p>
<p class=""><span class="">gY0AMIGJAoGBAMCPvwDY8F9d0ftJ7NfNUx1KR+ZJeOiFn+P/0gj8REjuHiFITr2qjpYvSZDItj/d</span></p>
<p class=""><span class="">F79ggZTIUYBX02Nl+xqBBbZGYsJFdkyzq4kGbuxaCXagCXpyz6uOfOLQ5GjB/YKbMwcTtTZLUPSM</span></p>
<p class=""><span class="">X8CczyWtuinGMzTz524wPZLMO6ahtlaxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAaJhCLZ9UVx4v</span></p>
<p class=""><span class="">iIvECXB9HbHJMOEzZw37c0+xJ2NbOfGEYTlyZuSHfUOigBDUP9dSHoWKTLdNcWZ4CkcS66M4ROG8</span></p>
<p class=""><span class="">ZHdDJFMo3WVtfbjFMSSMKPc4Qh2wS+qS51cxfiZTrv8AfFxJcxoyef0OxO9BpND4t0BrYw6HXyNj</span></p>
<p class=""><span class="">W1nmaX8=</span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">X509Certificate></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">X509Data></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">ds</span><span class="">:</span><span class="">KeyInfo></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">md</span><span class="">:</span><span class="">KeyDescriptor></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">SingleLogoutService</span></p>
<p class=""><span class=""> </span><span class="">Binding</span><span class="">=</span><span class="">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"</span></p>
<p class=""><span class=""> </span><span class="">Location</span><span class="">=</span><span class="">"<a href="http://spenc.autoidm.com:9090/auth/SAML2Auth">http://spenc.autoidm.com:9090/auth/SAML2Auth</a>"</span><span class=""> /></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">NameIDFormat></span><span class="">urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">md</span><span class="">:</span><span class="">NameIDFormat></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">AssertionConsumerService</span></p>
<p class=""><span class=""> </span><span class="">Binding</span><span class="">=</span><span class="">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</span><span class=""> </span><span class="">Location</span><span class="">=</span><span class="">"<a href="http://spenc.autoidm.com:9090/auth/SAML2Auth">http://spenc.autoidm.com:9090/auth/SAML2Auth</a>"</span></p>
<p class=""><span class=""> </span><span class="">index</span><span class="">=</span><span class="">"0"</span><span class=""> </span><span class="">isDefault</span><span class="">=</span><span class="">"true"</span><span class=""> /></span></p>
<p class=""><span class=""> </span><span class=""><</span><span class="">md</span><span class="">:</span><span class="">AssertionConsumerService</span></p>
<p class=""><span class=""> </span><span class="">Binding</span><span class="">=</span><span class="">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"</span></p>
<p class=""><span class=""> </span><span class="">Location</span><span class="">=</span><span class="">"<a href="http://spenc.autoidm.com:9090/auth/SAML2Auth">http://spenc.autoidm.com:9090/auth/SAML2Auth</a>"</span><span class=""> </span><span class="">index</span><span class="">=</span><span class="">"1"</span></p>
<p class=""><span class=""> </span><span class="">isDefault</span><span class="">=</span><span class="">"false"</span><span class=""> /></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">md</span><span class="">:</span><span class="">SPSSODescriptor></span></p>
<p class=""><span class=""></</span><span class="">md</span><span class="">:</span><span class="">EntityDescriptor></span></p><p class=""><span class=""><br></span></p><p class=""><span class="">4. Changed </span><span class="">dp.</span><span class="">encryption</span><span class="">.optional to false</span></p><p class="">5. Updated my SP's configuration</p><p class="">SP initiated SSO generates an AuthnRequest that is NOT signed which shib accepts but an unsolicited SSO fails.</p><p class=""><br></p><p class="">Thanks</p><p class="">Marc</p></span>
</div>
<div> </div></div></div></div>