CODEWITHSUNDEEP
samlsaml-2.0spring-saml
Trey T
Trey T

Reputation: 35

What's the use case for signed SAML IdP metadata?

Is having signed metadata useful in any way outside of the initial metadata exchange? What are the risks in skipping the signature the signature check?

Upvotes: 1

Views: 91

Answers (1)

Stefan Rasmusson
Stefan Rasmusson

Reputation: 5595

This is only to secure the initial exchange. About the risks. Its recommended to secure the transport of thw meta data in some way to ensure trust. This is just one more alternative to ensure trust. If you trust the channel where the metadata is delivered, there is no need to sign

Upvotes: 1

Related Questions