MartinH.63611 (Customer) asked a question.
Does OKTA Validate Signature on SAML Authentication Requests
We are a Service Porvider and have customer using OKTA as their IdP. We typically SIGN our SAML authentication requests, and our changing our certificate in next few months. For other IdPs like ADFS, the customer can add our new cert as a secondary cert and so the "switch" is seamless. I cant seme to find:1. Where in OKTA I would upload the SP signing certificate?2. If it is an option to DISABLE checking the signing of the request (or if OKTA does check even?) Thanks
This implies forceAuthn is not enforceable since the client may remove it from the SAMLRequest at will, allowing an attacker to gain access to more restricted services from an unattended session.