search

spring-attic / spring-security-saml

SAML extension for the Spring Security project
Other
419 stars 482 forks source link

Scope the AuthnRequest before signing #435

Closed oharsta closed 5 years ago

oharsta commented 5 years ago

Issue https://github.com/spring-projects/spring-security-saml/issues/419 en subsequent pull-request https://github.com/spring-projects/spring-security-saml/pull/420 introduced a bug. The optional scoping is applied after the authn message is signed. This erases the signature in the saml-core libraries.

This pull request applies the signing before the signing.