title: Should I require IdP's to sign SAML2 SSO responses?
body: <p>Our app has SAML2 SSO integration with 3 different (Shibboleth) IdP's. We are trying to add a 4th (also Shibboleth), but running into some issues, because our app expects all SSO responses to be verifiably signed. These other 3 are signing their responses, but the 4th is not, and is hesitant to add a custom config to enforce signing for our app.</p>
  
  <p>Technically I could modify our app to accept unsigned SSO responses, but I am wondering whether or not I should. What are the pitfalls of allowing unsigned SSO responses? Is there any security vulnerability?</p>
  
  <p>Is there any Shibboleth (or other SAML2 SSO) documentation that recommends signing responses as a best practice?</p>