I'm implementing a SAML2 Service provider that will be running on a public facing web site. The sign in functionality is publicly available, so anyone can get hold of a AuthnRequest from my site.
When I do receive a response from the Idp, do I have to validate the InResponseTo field to make sure that the response is to a AuthnRequest I've issued or can I ignore it?
I don't understand how it would add any extra security when I'm already validating the signature of the response and have a replay protection by only allowing each assertion id to be used once within the validity time of the assertion (as specified by the condition).