OpenSAML v3 signing and validating SAML Objects

[Cantor, Scott]

On 4/27/20, 6:37 AM, "dev on behalf of Paul Statham" <dev-bounces at shibboleth.net on behalf of paul.statham81 at gmail.com> wrote:

> Sorry done a bit more digging around the Spring WS signing the response. So it appears to add a security header to the
> soap header of the enveloped response. This references the SAML elements within the body. Is this valid from a SAML
> 2.0 SOAP binding perspective?

It's a bad idea if it's core to the securing of the message, but the binding doesn't outlaw it (it probably should,  but it doesn't).

If the message is expected to be signed you would not want to rely on WS-Security to achieve that.

-- Scott