IdP ProfileConfiguration element attribute default values

[Cantor, Scott]

On 5/24/12 3:58 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>
>
>Which are the defaults that will be used when the
>ProfileConfiguration is thus:
>
><ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
>
>?

I think the documentation is wrong.

http://svn.shibboleth.net/view/java-shib-common/tags/1.3.5/src/main/java/ed
u/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2Arti
factResolutionProfileConfigurationBeanDefinitionParser.java?revision=1020&v
iew=markup

The 2.3 release changed defaults to match SAML guidance to sign assertions
and not responses. Literally weeks (possibly days) later the disclosure of
XML Encryption's CBC bug broke and one of the mitigations is to sign
responses. Life's a bitch.

It would be very obtuse to try and guess the behavior of the system in
such a critical respect by leaving out those settings in any case, no
matter what the defaults are. I would never leave them to chance.

-- Scott