SignAssertions action not needed ?

[Cantor, Scott]

On 2/6/14, 5:28 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>If SecurityParametersContext is present but
>getSignatureSigningParameters() returns null, that is an error,
>correct ?

Based on what was said, that depends. For the signAssertions action, no,
it means signing them wasn't enabled, so it's a "skip" indicator.

For certain message encoders, there will be exceptions where signing is
mandatory and it would be an error. Principally the SAML 1 POST encoder.

Or it could be viewed as a "shoot yourself in the foot" case and be left
to the deployer to not set options that would be broken, but I tend to
lean away from putting people in that boat.

I don't recall what V2 does if you set signing to "never" for both
assertions and responses. If that doesn't fail, then we're already in that
mode I guess.


-- Scott