OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Christopher Bongaarts]

Cantor, Scott wrote:

>> (and also curious what the security
>> ramifications are of doing so - i.e. is this really a valid workaround?).
> 
> It's up to the profile to define what has to be signed. SAML 2 was
> explicitly designed to allow only the assertion to be signed in the SSO
> profile. The profile has to be followed for that to be correct, and
> omitting checks the profile requires can easily render the entirety
> unsafe, possibly depending on which part is signed. That's why people
> cherry picking the profile are dangerous.

I see that the defaults for those values changed in IdP 2.2.1.  That 
explains why ours were still set to the old values (migrating old config 
files with the "defaults" documented... ;)

Then I'll just plan to update the relying-party files on the IdPs to 
bring them consistent with the SSO profile and be done with it.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%