OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Cantor, Scott]

On 9/14/11 3:44 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>I am still curious why signing the assertions instead of the response as
>a whole changes the behavior here

Depends on their code, I guess. The marshalling must take place between
those points. Presumably they eventually marshall the response, and that
marshalls the assertions, so by the time that code runs, it's been done.

> (and also curious what the security
>ramifications are of doing so - i.e. is this really a valid workaround?).

It's up to the profile to define what has to be signed. SAML 2 was
explicitly designed to allow only the assertion to be signed in the SSO
profile. The profile has to be followed for that to be correct, and
omitting checks the profile requires can easily render the entirety
unsafe, possibly depending on which part is signed. That's why people
cherry picking the profile are dangerous.

-- Scott