We want to enable the SAML AuthNRequest with embedded signature (HTTP-POST binding) using the WSO2 server as IDP server.
We have marked the Enable Signature Validation in Authentication Requests and Logout Requests option while setting up the service provider in the WSO2. We have also added the application certificate in Upload SP certificate field. The Certificate Alias is selected as wso2carbon
While doing the SAML request we are signing the request like as mentioned on [https://www.samltool.com/generic_sso_req.php][1]. We have checked the requests are getting sent correctly.
Problem is if we pass the incorrect certificate details in the SAML request, still WSO2 server allowing the user to login instead of rasing Auth failures. Looks like the WSO2 is not checking the SIGN of the request while authentication.
Am I missing anything while configuring the service provider? Also is there any tutorial available for how should we set the Service Provider with AuthNRequest then that will be very helpful. Thank you.