<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Mar 15, 2015 at 7:24 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">>Second, in this case this is a purely academic discussion because SP initiated SSO doesn't sign the authnrequest and it completes just fine. So either there's a bug that is allowing an authnrequest to not signed or there's a bug where the unsolicited SSO is being too restrictive regardless of settings.<br>
<br>
</span>And this would be wrong. If you think the SP is not signing its request, you're mistaken (or there's different metadata in the two cases).<br>
<div class="HOEnZb"><div class="h5"><br></div></div></blockquote><div>You are correct, I was mistaken. I forgot that this was HTTP-Redirect and the signature is not in the authnrequest. </div></div></div></div>