Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Allow AuthnRequests to be signed at the SessionInitiator level

Description

We have an IdP provider that accepts AuthnRequests in two ways:

  • Unsigned via HTTP-Redirect

  • Signed via HTTP-POST

Any other combination is not accepted, e.g. an unsigned AuthnRequest via HTTP-POST will not be accepted.

We are currently in the process of migrating from the first to the second option, and during the transition period it would be nice to have both options available. It is currently already possible to create two separate SessionInitiators for the same IdP, one using HTTP-Redirect and the other one using HTTP-POST – with the implicit understanding that you need to explicitly visit the secondary SessionInitiator's URL to trigger it, which is fine.

However, the option of signing the AuthnRequests can only be set at the IdP level, either via the signing attribute on a RelayingParty/ApplicationDefaults XML element in the config, or via the WantAuthnRequestsSigned attribute in IdP metadata. It would be nice to be able to additionally have requests signed by setting a flag at the SessionInitiator level.

Attached is a quick and dirty patch that brings the equivalent of the WantAuthnRequestsSigned flag on IdP metadata down to the SessionInitiator level. I tested it and it works fine, but it's up to your consideration.

Environment

None

Attachments

1
  • 19 Nov 2013, 11:14 AM

Activity

Show:

Scott Cantor May 11, 2016 at 9:04 PM

Updated documentation.

Scott Cantor May 11, 2016 at 6:33 PM

2297db97eb2644fbb1a1c83cdbc43bcef5ef2057

Added signing/encryption as initiator and handler attributes, and implemented it to check for them before falling back to RP or Application settings.

Documentation TBD.

Scott Cantor May 11, 2016 at 5:06 PM

It's a bit complicated to know whether the RelyingParty settings or the Handler settings should take precedence, but as long as it's consistent I guess either is ok.

But I prefer to just duplicate the signing and encryption properties than to introduce something else, and just be specific about which setting "wins".

Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Created November 19, 2013 at 11:14 AM
Updated June 29, 2016 at 4:22 PM
Resolved May 11, 2016 at 9:04 PM

Flag notifications