Passthrough of SAML response by SP to application

[Dennis Wagelaar]

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
*snip*

> [DW] I've just tried out Assertion Export, but I get a stripped-down 
> SAML response, not the original (see attachment). In particular, all 
> signature information is missing, which is necessary to re-validate 
> the SAML response on the delegated web service (i.e. SP B wants to 
> verify that "user X is authenticated and connected to SP A"). Is there 
> any way to retrieve the cryptographic signature as well?

As I originally noted, you can't do that legally, the assertion is not valid for use by the downstream system.

In any case, it's not stripping anything. If it's not signed, it wasn't signed to begin with, probably the response was.

[DW] Of course! I was mixing up the entire Response with the contained Assertion element (need to get more familiar with the SAML universe still). I can see how the Assertion alone is not going to help downstream. I suppose "Response Export" is what I need... Then the question becomes: can I use the entire signed Response downstream, given that the identity of the SP that forwarded the Response downstream has been verified? If again the answer is "no", can you point me to some literature that explains why?

Thanks a lot!
--Dennis