SP generating signed ECP AuthnRequests

[Jim Basney]

Hi,

I'm having trouble configuring Shibboleth SP 2.4.3 to generate signed
ECP AuthnRequests and would appreciate any help. In
/etc/shibboleth/shibboleth2.xml I've got:

  <ApplicationDefaults id="default" policyId="default"
                       entityID="https://cilogon.org/shibboleth"
                       REMOTE_USER="persistent-id targeted-id eppn"
                       signing="true" encryption="false"
                       homeURL="https://test.cilogon.org/"
                       metadataAttributePrefix="Meta-">

and I'm seeing signed AuthnRequests for Web Browser SSO but not for ECP.
I'll include examples below.

Is there a separate ECP signing option I'm missing?

Thanks,
Jim

===== BEGIN Web Browser SSO Authn Request ====

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

AssertionConsumerServiceURL="https://test.cilogon.org/Shibboleth.sso/SAML2/POST"

Destination="https://idp.protectnetwork.org/protectnetwork-idp/profile/SAML2/POST/SSO"
                    ID="_299f3f63c1b23ebf7ccedb2e69052c16"
                    IssueInstant="2012-04-23T12:57:10Z"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://cilogon.org/shibboleth</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#_299f3f63c1b23ebf7ccedb2e69052c16">
                <ds:Transforms>
                    <ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </ds:Transforms>
                <ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

<ds:DigestValue>hjuxf14EdV3N69oH4cxKjaxhxW4=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>

<ds:SignatureValue>RRMfRtisWq0MjxHPCH4DcGWoSDV20x/AgOhLdq0gMr9oBI11w9jU5oP+rb1XX747
gKzTPpx02comEekFX51zP/QjqdlPbbZvMsf3XbI7zTTC4q1B/3OAxEWk9FweSFtL
GjXauvRNbvyTADHP5ecjyDerSNoWocGThDD+8aSSmfH9Qzfn/ayf/eocUzFarWnZ
bPfhGuUCW8MaNUOjL6XkKPA7euWupPyJ7Az/day6iCOjSHOOY9tsDteMk3w6VuAr
wjjDs7rd8uRa0vleJ4qIJ0DTTz5LTBtdXAC3ckk5EW4fiG6y08mdE/f7EteLuhbB
0sNLZucOxpjeJ5deck5L6w==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:KeyName>cilogon.org</ds:KeyName>
            <ds:X509Data>
                <ds:X509SubjectName>CN=cilogon.org</ds:X509SubjectName>

<ds:X509Certificate>MIIDVDCCAjygAwIBAgIJAI4ktgTnvdBvMA0GCSqGSIb3DQEBBQUAMBYxFDASBgNV
BAMTC2NpbG9nb24ub3JnMB4XDTEwMDEyODE3MzYwNFoXDTEzMDEyNzE3MzYwNFow
FjEUMBIGA1UEAxMLY2lsb2dvbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCU2+Mqs1OhxQRdrJ+W19BUgquVG/3rxd9EDzwGOWBkO+awCXtRe50p
LGVXYF/ylNXeAdF2LHICKHB35i/ZNnXj9Y+llarHiTyrrSmYa3OA0Q2YEzSsv6o6
rk4+SysmnFPLggVbFnqmtCRn7bwAodonhWWfVqwBj+GkO3RoedfCYhfsiKJOTioN
Bc1VXlNlxBeAVYuJuhDzCQnSn+IhLnqKWXpnq2exZfeOG+yfUQB31BONSnCWadFW
ODgybq5q+D4IDFeW+2LmQGNVCjUnB7RTGwRWgj2AHusySohpwDCha1eIqXb+FNGA
ifI2PEgCS69NgBJNMaAvAAjcEUugK0bfAgMBAAGjgaQwgaEwDgYDVR0PAQH/BAQD
AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAJBgNVHRMEAjAAMB0G
A1UdDgQWBBS6KexHniS9+CMFdNlM/DILrMQ3AjBGBgNVHSMEPzA9gBS6KexHniS9
+CMFdNlM/DILrMQ3AqEapBgwFjEUMBIGA1UEAxMLY2lsb2dvbi5vcmeCCQCOJLYE
573QbzANBgkqhkiG9w0BAQUFAAOCAQEAS4U3vwFFyjsezayUJcVm6PW40HIJW3iV
qaNv/8dwPFKtX03C3XEMnexFegnZ4cYSTAc5fdpAxaEZjnhTsKsA5aFKHlF1uUYn
5beFDAbLDn5AlJamBoYn3s8ZOa0x9A1FdrDLSLTUqc1BH1Hz8MRFR/NsD/LdI1I5
5tIY6A/0lAlOgq/+iRyAzc/NZloHRJriiysJzRLWq1oF2VlW0fgkF7v1tf7oBZjq
SPTVAuw69SbXBXnaHQXN2DnsdUhepjQTumKi+S1sZhAMW9nVNFXVBkehfr5NUFR+
8QVxZNy6yZE12GjQMJc6YbNQ8kiC2gzqTimid0/2DzSakuhgAMacNg==
</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>

==== END Web Browser SSO AuthnRequest ====

==== BEGIN ECP AuthnRequest ====

<S:Envelope
xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Header><paos:Request
xmlns:paos="urn:liberty:paos:2003-08"
S:actor="http://schemas.xmlsoap.org/soap/actor/next"
S:mustUnderstand="1"
responseConsumerURL="https://test.cilogon.org/Shibboleth.sso/SAML2/ECP"
service="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"/><ecp:Request
xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp" IsPassive="0"
S:actor="http://schemas.xmlsoap.org/soap/actor/next"
S:mustUnderstand="1"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://cilogon.org/shibboleth</saml:Issuer></ecp:Request><ecp:RelayState
xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"
S:actor="http://schemas.xmlsoap.org/soap/actor/next"
S:mustUnderstand="1">cookie:daa0c2d2</ecp:RelayState></S:Header><S:Body><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://test.cilogon.org/Shibboleth.sso/SAML2/ECP"
ID="_3a6a60e741eea911fc84511958e4eb80"
IssueInstant="2012-04-23T12:49:18Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://cilogon.org/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest></S:Body></S:Envelope>

==== END ECP AuthnRequest ====