ProfileConfiguration - signResponses="always" signAssertions="always"

[Chad La Joie]

Yes, if you sign the Response the Assertion is also covered.  But if you
then extract the Assertion and send it on to something else (as happens
in delegation), you lose the signature so the recipient can no longer
verified that the Assertion has not been tampered with.

On 2/29/12 9:39 AM, Zmuda, Matthew R wrote:
> But assertion is in the response (encrypted). So even if assertion is not specifically signed would it not inherit the response super-signature as per signature inheritance?
> 
> Thanks,
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
> Sent: Wednesday, February 29, 2012 9:32 AM
> To: Shib Users
> Subject: Re: ProfileConfiguration - signResponses="always" signAssertions="always"
> 
> Completely depends on your use case.
> 
> Normally you only need to sign one of them.  Because the response
> doesn't carry any sensitive information and because there are use cases
> where you want to be able to snip out the Assertion and use it and
> maintain the signature we moved our default configs to not sign the
> response but instead sign the assertion.
> 
> Whether that makes sense for your deployment or not is really something
> you have to decide.
> 
> On 2/29/12 9:15 AM, Zmuda, Matthew R wrote:
>> Does it make sense to ever sign both response and assertion?
>>
>> To me it seems like signing both may be unnecessary processing.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
> AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net