<html><body><div dir="ltr">
Thank you Scott and Paul!</div><div dir="ltr"><br></div><div dir="ltr">The request was signed (though their metadata has <span style="color:rgb(47,180,29);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">AuthnRequestsSigned</span><span style="font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">=</span><span style="font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">“false”)</span></div><div dir="ltr"><span style="font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><br></span></div><div dir="ltr"><font face="ui-sans-serif, sans-serif" style="font-size:13px">David </font></div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Apr 23, 2024 at 16:49:26, Paul B. Henson <<a href="mailto:henson@cpp.edu">henson@cpp.edu</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div>
<div>
Is the authn request signed? Per the spec for POST,<br><br>"If the message is signed, the Destination XML attribute in the root SAML<br>element of the protocol message MUST contain the URL to which the sender has<br>instructed the user agent to deliver the message."<br></div></div></blockquote><br></div>On Apr 23, 2024 at 16:39:12, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_quote">What is wrong with that request+metadata combination ?<br><br></div></blockquote>No Destination attribute. I thought we only enforced the requirement for signed messages, but not sure.<br><br>— Scott<br><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_quote"><br></div></blockquote><div class="gmail_quote"><blockquote class="gmail_quote" type="cite" style="margin-left:0.8ex;padding-left:1ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204)"><pre style="border:1px solid rgb(206,206,206);background-color:rgb(248,248,248);padding:10px;border-radius:4px;margin-top:0px;margin-bottom:0px"></pre></blockquote>
</div></body></html>