ProfileConfiguration - signResponses="always" signAssertions="always"

[Zmuda, Matthew R]

But assertion is in the response (encrypted). So even if assertion is not specifically signed would it not inherit the response super-signature as per signature inheritance?

Thanks,

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
Sent: Wednesday, February 29, 2012 9:32 AM
To: Shib Users
Subject: Re: ProfileConfiguration - signResponses="always" signAssertions="always"

Completely depends on your use case.

Normally you only need to sign one of them.  Because the response
doesn't carry any sensitive information and because there are use cases
where you want to be able to snip out the Assertion and use it and
maintain the signature we moved our default configs to not sign the
response but instead sign the assertion.

Whether that makes sense for your deployment or not is really something
you have to decide.

On 2/29/12 9:15 AM, Zmuda, Matthew R wrote:
> Does it make sense to ever sign both response and assertion?
> 
> To me it seems like signing both may be unnecessary processing.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.