search

plp050452 / simplesamlphp

Automatically exported from code.google.com/p/simplesamlphp
Other
0 stars 0 forks source link

Check that the Issuer of the response against the IdP we sent the message to #442

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
We should consider validating that the <saml:Issuer> in the <samlp:Response> 
matches the IdP we meant to send the AuthnRequest message to.

Original issue reported on code.google.com by olavmrk@gmail.com on 25 Oct 2011 at 1:18

GoogleCodeExporter commented 8 years ago 
If the response contains an InResponseTo attribute that links back to an 
AuthnRequest, then I agree this is a good idea. If there is no InResponseTo 
attribute, then the response is considered to be an unsolicited response.

Original comment by trsc...@gmail.com on 25 Oct 2011 at 1:39

GoogleCodeExporter commented 8 years ago 
Implemented in r3189.

Original comment by jaim...@gmail.com on 15 Oct 2012 at 10:38