IdPv3 default config for the SSO profile to sign only the response but not the assertion is in contradiction with SAML2int 0.2.1

[Thomas Lenggenhager]

The Shibboleth IdPv3 default config for SSO and ECP signs only the 
response, but not the assertion within the response as documented in [1] 
in chapter 'System Profile Defaults'.

The current SAML2int version 0.2.1 [2] requires in chapter '9.1 Binding 
and Security Requirements':

> Whether encrypted or not, the <saml2:Assertion> element issued by the
> Identity Provider MUST itself be signed directly using a
> <ds:Signature> element within the <saml2:Assertion>.

Unfortunately, the SAML2int web site does not provide any information on 
why and when this requirement was introduced. It was not in version 0.1. 
Anyhow, the SAML2int governance is completely unspecified.

Based on that, all Shibboleth IdPv3 with default config are not SAML2int 
compatible.

Is this a known fact or does it require to adapt the default config in a 
next release?

Thomas

BTW: The more recent draft spec 'SAML V2.0 Implementation Profile for 
Federation Interoperability' [3], developed by InCommon and now at 
Kantara, contains this common requirement for IdPs and SPs, that is 
compatible with the IdPv3 default config:

> [IIP-SSO04]
> Implementations MUST support the signing of assertions and
> responses,both together and independently.


[1] 
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-SystemProfileDefaults

[2] http://saml2int.org/profile/current/

[3] https://kantarainitiative.github.io/SAMLprofiles/fedinterop.html

-- 
SWITCH
------
Thomas Lenggenhager, Central Solutions
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 1505  direct +41 44 268 1541
https://www.switch.ch