Passthrough of SAML response by SP to application

[Cantor, Scott]

On 7/17/12 4:46 AM, "Dennis Wagelaar" <dennis.wagelaar at healthconnect.be>
wrote:
>
>[DW] Of course! I was mixing up the entire Response with the contained
>Assertion element (need to get more familiar with the SAML universe
>still). I can see how the Assertion alone is not going to help downstream.

That isn't the reason. If you want the assertion signed, you can do that.
That changes nothing related to validity, audience, subject confirmation,
etc.

> I suppose "Response Export" is what I need...

No.

> Then the question becomes: can I use the entire signed Response
>downstream, given that the identity of the SP that forwarded the Response
>downstream has been verified? If again the answer is "no", can you point
>me to some literature that explains why?

No, you can't, the response is meant for, targeted for, and only valid for
the recipient it was intended for, the SP. All of that is baked into the
message.

There's no literature of any significance on SAML, only the standard
itself.

-- Scott