{"action":"opened","issue":{"url":"https://api.github.com/repos/SURFnet/idin-proxy/issues/5","repository_url":"https://api.github.com/repos/SURFnet/idin-proxy","labels_url":"https://api.github.com/repos/SURFnet/idin-proxy/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/SURFnet/idin-proxy/issues/5/comments","events_url":"https://api.github.com/repos/SURFnet/idin-proxy/issues/5/events","html_url":"https://github.com/SURFnet/idin-proxy/issues/5","id":134577097,"number":5,"title":"As a iDIN Proxy system I want to validate the SURFconext authentication requests so that I make sure that the service provider is authentic (and not a malicious service provider trying to phish private information about a user)","user":{"login":"dotnet18","id":1764625,"avatar_url":"https://avatars.githubusercontent.com/u/1764625?v=3","gravatar_id":"","url":"https://api.github.com/users/dotnet18","html_url":"https://github.com/dotnet18","followers_url":"https://api.github.com/users/dotnet18/followers","following_url":"https://api.github.com/users/dotnet18/following{/other_user}","gists_url":"https://api.github.com/users/dotnet18/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet18/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet18/subscriptions","organizations_url":"https://api.github.com/users/dotnet18/orgs","repos_url":"https://api.github.com/users/dotnet18/repos","events_url":"https://api.github.com/users/dotnet18/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet18/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-18T13:12:30Z","updated_at":"2016-02-18T13:12:30Z","closed_at":null,"body":"•\tThe SURFconext Service Provider Metadata details are used to validate the authentication messages received from the SURFconext system\r\n•\tThe iDIN Proxy system consults the trusted service provider in metadata before issuing an authentication response\r\n•\tThe iDIN Proxy looks up a pre-arranged endpoint location of the service provider in metadata\r\n•\tThe Service Provider's Assertion Consumer Service (the Identity Provider should perform a case-sensitive string comparison between the requested <saml2p:AssertionConsumerServiceURL> value and the values found in the Service Provider's metadata).\r\n•\tThe signature of the authentication request message using the certificate provided by the Service Provider's metadata is validated.\r\n"}}