SignAssertions action not needed ?

[Cantor, Scott]

On 2/6/14, 7:52 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>For example, if signAssertions=true but (somehow) no
>SignatureSigningParameters and signing credential is available, then
>that's an error - although in my envisioned model that would happen in
>the Action that evals that flag and then attempts to resolve and
> populate the params, not in the signing Action.  Same for encryption.
>encryptionAssertions=true + no encryption credential resolved from
>metadata = error.

Yes.

>Hmmm. SAML 1 POST, that's not ringing a bell...why is that mandatory?
>Does the spec just make it required?  I'd have to look at what we did in
>v2 also, but I'm not 100% sure we implement that...

In SAML 1, POST isn't really a binding, it's part of the SSO profile, and
the protections rely on signing the response, you can't just sign the
assertion. It's the only case like that offhand.

What I vaguely recall is that we may have just hardwired the flag on for
that profile configuration in the Spring parser. Which we could do again I
guess.

>And in v3, at least for SAML protocol message signing with enveloped XML
>signature, the signing is done in MessageHandlers, so the encoder would
>not do this.

Yes, I should have said "the outbound message handling/encoding steps".

>I'd have to go back and check but I don't recall us failing in that case.
> I think it does what you tell it and if you shoot yourself, that's your
>right. :-)  But not 100% sure.

I think we just prevented that case from reaching the IdP at config time.

-- Scott