<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
> Also you aren't circumventing signing the authn request you are kicking off authentication directly from the idp so its not exactly the same thing.<br>
<br>
</span>You cannot kick off authentication from the IdP, you can only do it from a client. If that request is unsigned, then we aren't requiring signed requests ergo the feature isn't being honored. Security settings you can circumvent that easily really are broken.<br>
<div class="HOEnZb"><div class="h5"><br></div></div></blockquote><div><br></div><div>First off I disagree with the premise that it is some how less secure using unsolicited (or idp initiated using the more common phrase in government and private industry) sso if authnrequests need to be signed. The only security benefit to signing an authnrequest is to validate any of the input from the request that can over-ride the metadata or have the idp make decisions (ie changing the assertionconsumerservice url, choosing a nameid, etc). Otherwise an authnrequest is just a link that says "authenticate the user for a particular service provider" in which case a digitial signature would be no more beneficial from a security standpoint then a link to <a href="http://shibboleth.net">shibboleth.net</a>. Since an unsolicited/idp initiated sso shouldn't allow you to override whats in the metadata requiring a signature from the originator doesn't provide any security benefit. </div><div><br></div><div>Second, in this case this is a purely academic discussion because SP initiated SSO doesn't sign the authnrequest and it completes just fine. So either there's a bug that is allowing an authnrequest to not be signed or there's a bug where the unsolicited SSO is being too restrictive regardless of settings.</div><div><br></div><div>Thanks</div><div>Marc</div></div></div></div>