Copilot commented on code in PR #152: URL: https://github.com/apache/dubbo-go-pixiu-samples/pull/152#discussion_r3252600415
########## auth/saml/README.md: ########## @@ -110,6 +110,24 @@ http://localhost:18080/realms/pixiu/protocol/saml/descriptor This URL matches the `idp_metadata_url` used in `pixiu/conf.yaml`. +### Disable `Client signature required` on the SAML client + +Keycloak's SAML clients default `Client signature required=ON`, which forces the SP to sign every AuthnRequest. Pixiu's SAML filter does not sign AuthnRequests, so leaving this on causes Keycloak to reject the redirect with `error="invalid_signature"` / `SigAlg was null`. Run the following from your host to toggle it off (Assertion / Response signing on the IdP side is kept on, so the SAML response is still cryptographically protected): Review Comment: The phrase “SAML clients default `Client signature required=ON`” is grammatically awkward; use “default to” to make the instruction clearer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
