A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a correct answer or have I missed something?
Not signing a SAML-ticket would be a very bad idea because you would be an easy target for "Man in the middle-attack", Am I correct?