CODEWITHSUNDEEP
apacheauthenticationsamlmellon
ThemThem
ThemThem

Reputation: 38

Apache mod auth mellon force to check signature

I am using the mod auth mellon on apache for authentication on my SP.

I have added on the SP metadata the directive to require signed resonses

<SPSSODescriptor
   AuthnRequestsSigned="true"
   WantAssertionsSigned="true"
   protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"
>

But when receiving the response from the IdP I see that removing the signature does not render the response not-accepted, so I am still able to login.

The documentation for Mellon is somewhat outdated and other than the readme.doc there are not a lot of resources.

**Does anyone know how I can force mellon to check the SAML Response signature? **

I tried already searching on SO for this. I made sure that all the SAML Responses had a signature value in their payload. I made sure that the signature value matched the public key value of the IDP.

Upvotes: 1

Views: 250

Answers (0)

Related Questions