Saml: Is it necessary to trust and verify public key for ssl when the artifact response is signed? -


i've made implementation based on filesystemmetadataprovider: https://github.com/vdenotaris/spring-boot-security-saml-sample

to make ssl handshake artifact binding work put ssl sertificates endpoint in idps metafile(i tried put both leaf , ca in cacerts on jre , trust store of server didn't work).

i don't want maintenance generating certificates , modifing idps metafile when leaf certificate changes.

is necessary mess transport layer? isn't enough check ssl certificate valid , after check signature of assertion?

i asked idp. few choose trust ssl certificate , should enough validate ssl certificate , check signature in assertion.


Comments

Popular posts from this blog

Ansible - ERROR! the field 'hosts' is required but was not set -

customize file_field button ruby on rails -

SoapUI on windows 10 - high DPI/4K scaling issue -