Possible Vulnerability: Auth Request sends the service providers validation certificate about gosaml2 HOT 2 CLOSED

This is the intended behavior and not a security issue.

You can see a similar example of a signed request here: https://www.samltool.com/generic_sso_req.php

In a simple configuration the Identity Provider can receive this signed request, and simply ignore the KeyInfo element containing the certificate and just validate the signature using a certificate it has been statically configured with.

The reason the certificate is sent along at all is so that the Identity Provider can (if it chooses) use more complex PKIX schemes, like trusting a root certificate and verifying that the certificate supplied by the Service Provider has a valid chain of trust back to that root.

In practice a lot of identity providers don't seem to even require that requests be signed, but all of the above also applies in reverse to the Response flow.

from gosaml2.

Thank you for clarifying that. Great minimalistic saml plugin btw.

from gosaml2.