<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4510">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: unsolicited SSO question regarding AuthnRequestsSigned="true"</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Les,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">You won't be able to make unsolicited SSO requests on behalf of a vendor that requires AuthnRequestsSigned. Yes, they are mutually exclusive, and for them to not be, you would need the SP's private key, which is a bad idea for all kinds of reasons.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Signed AuthnRequests only add value in a very limited number of use cases. I don't know if you're working with one or not.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">The ability to send a truly unsolicited assertion would be accomplished most naturally by removing that flag from their metadata. It's the obverse but it still demonstrates the fact:</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration</a></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><span style="background-color:#ffffff; color:#172b4d; font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,"Fira Sans","Droid Sans","Helvetica Neue",sans-serif; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Another way you can disable support for this feature for specific services is by modifying their SAML metadata to include<span> </span></span>AuthnRequestSigned="true"<span style="background-color:#ffffff; color:#172b4d; font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,"Fira Sans","Droid Sans","Helvetica Neue",sans-serif; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><span> </span>in the </span><SPSSODescriptor><span style="background-color:#ffffff; color:#172b4d; font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,"Fira Sans","Droid Sans","Helvetica Neue",sans-serif; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><span> </span>element. Doing so causes the IdP to require requests from that SP to be signed, and since this protocol does not allow for signing, it will cause such requests to fail with an error.</span></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">The rest would all be true from my perspective.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Take care,</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Nate.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">--------</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><img src="https://www.signet.id/wp-content/uploads/2019/08/signature-e1566142203123.png" /></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="4">The Art of Access</font> <strong>®</strong></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><strong>Nate Klingenstein</strong> | Principal</font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><a href="https://www.signet.id/">https://www.signet.id/</a> </font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Les LaCroix<br /><strong>Sent:</strong> Tuesday, October 22 2019, 9:46 am<br /><strong>To:</strong> Shib Users<br /><strong>Subject:</strong> unsolicited SSO question regarding AuthnRequestsSigned="true"<br /><br /><!-- begin sanitized html --><div dir="ltr"><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">Hi,</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">I have a vendor that requires unsolicited SSO. Their metadata says 'AuthnRequestsSigned="true"'. When I go to the unsolicited SSO link</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">https://.../idp/profile/SAML2/Unsolicited/SSO?providerId=vendorID</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">I get the error " SPSSODescriptor for entity ID ... indicates AuthnRequests must be signed, but inbound message was not signed". I am watching my browser traffic and it's only interacting with the IdP. The error is happening before the IdP sends any SAML back, and there is no explicit authnRequest SAML being sent. Also, I am doing this in an incognito window, and it's happening before I go through a login flow.</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">Since there isn't any interaction with the SP, does that mean that AuthnRequestsSigned="true" in SP metadata and unsolicited SSO are mutually exclusive? I can imagine that the IdP is, in effect, responding to an implicit authN request made on behalf of the SP. There is clearly no way an (implicit) request could be signed with the SP's (private) signing key. Most of the conversations on this topic in the list archive essentially end up with "tell the vendor to fix their metadata." Is there any place I can point the vendor to that says AuthnRequestsSigned must be "false" for unsolicited SSO so they will fix their metadata?</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">On the other hand, there isn't any explicit authnRequest being sent. In that case I kind of feel like the IdP should ignore the SP's AuthnRequestsSigned, and the metadata isn't wrong, per se. It puts me in a much weaker position to ask them to change it. Also, if they ever implemented SP-initiated SSO, AuthnRequestsSigned="true" seems like it might be a good idea.</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">Is this a problem with the vendor's metadata? A problem with the IdP? Or just a problem with my understanding of SAML? :-) I can change my local copy of the metadata to say AuthnRequestsSigned="false", and that's what I'm doing while I try to convince them to change it at the source. It's a problem lying in wait if we ever have to update their metadata, though.</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">Thanks in advance, -Les</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default">p.s. I am seeing this with IdP 3.4.3, in case that matters.</div><div style="color:#073763; font-family:trebuchet ms,sans-serif; font-size:small" class="gmail_default"> </div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><hr style="color:#000000; font-family:"times new roman","new york",times,serif; font-size:16px" /><div style="color:#000000; font-family:"times new roman","new york",times,serif; font-size:16px; text-align:right"><span style="color:#996633; font-size:small">Les LaCroix '79 </span><span style="color:#996633">|</span><span style="color:#996633; font-size:small"> </span><span style="color:#996633; font-size:small">Strategic Technologist</span><br /><span style="color:#996633; font-size:small">Carleton College </span><span style="color:#996633">|</span><span style="color:#996633; font-size:small"> 1 N. College St. </span><span style="color:#996633">|</span><span style="color:#996633; font-size:small"> MS 3-ITS </span><span style="color:#996633">|</span><span style="color:#996633; font-size:small"> Northfield, MN 55057</span><br /><span style="color:#996633; font-size:small">507.222.5455</span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>