top | item 43962144

Ask HN: Should You Include a Certificate in a SAML AuthnRequest?

5 points| andy89 | 9 months ago

When implementing SAML authentication, one question often arises:Should the Service Provider (SP) include its certificate directly in the <AuthnRequest>?

2 comments

oftenwrong|9 months ago

I am not an expert in SAML, but my understanding is that the cert is typically included in the SP metadata. It seems to me that icluding the SP cert in the AuthnRequest would defeat the purpose of signing the request. Is that supported in the standard?

stop50|9 months ago

Why, the other side should already know it.