HTTP-Post-SimpleSign credentials

[Brent Putman]

On 8/10/11 3:21 PM, James Bardin wrote:
>
> When I request that binding though, the IdP still only return the
> xmlsig in the response.

Right, but to be precise that XML signature should be on the Assertion
and not the Response (at least for a default IdP config).  Subtle
difference.


>  The logs show
> "No signing credential was supplied, skipping HTTP-Post simple signing".

> I have all the credentials for my test systems, and they can encrypt
> and sign normally. Is there another set of credentials used for this?

It uses the same credentials, but you have to tell it to sign the
outbound SAML protocol message instead of (or in addition to) the
Assertion.  For that you need to have the right signResponses value set
for the effective ProfileConfiguration for type "saml:SAML2SSOProfile". 
The default relying-party.xml has signResponses="never", you'd need to
change to "always".    You may also want to adjust the default
signAssertions="always" as well.

Note this affects signing of the outbound protocol message according to
the binding in use, so if it's regular HTTP-Post, you'd get an XML
Signature; if HTTP-Post-SimpleSign or HTTP-Redirect DEFLATE, you get the
binding-specific signature.  So if it's just specific non-Shib SP's that
are problematic, you might want to have custom RelyingParty definitions
for those (if you don't already).