<p dir="ltr">While I understand your argument, it goes counter to most other SAML products. Adfs, openam, oif, ping, etc all work this way. Also you aren't circumventing signing the authn request you are kicking off authentication directly from the idp so its not exactly the same thing. </p>
<p dir="ltr">Thanks<br>
Marc</p>
<div class="gmail_quote">On Mar 15, 2015 1:23 PM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 3/15/15, 12:00 PM, "Marc Boorshtein" <<a href="mailto:mboorshtein@gmail.com">mboorshtein@gmail.com</a>> wrote:<br>
<br>
>It looks like the idp is looking for an authnrequest even though one doesn't exist. Is this a bug?<br>
<br>
That's debateable. I don't know what V2 did/does in this case, but even if it "works", I could make a pretty strong case that the V2 behavior is the bug. I don't think I'm inclined to change this. If the metadata says the SP signs its requests, you shouldn't be able to circumvent that, it would make the feature worthless.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>