Getting Signed SAML assertion in application

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2014-01-20 13:38]:
> * Stefan Rasmusson <rasmusson.stefan at gmail.com> [2014-01-20 13:31]:
> > In our application we have the need to get the entire signed SAML
> > assertion. Because of security reasons our backend does not trust the
> > frontend or shiboleth SP and must be able to verify the IDP signature.
> > Is it possible to get the Assertion from the application some how?
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExport

That won't help with those "security reasons, though, as that does not
expose the "raw" assertion as recieved (I think). But If you need the
signature on the assertion to be intact that basically means the
assertion has to be verbatim. Which would also mean that all encrypted
data (assertion, attributes or NameIDs) need to remain
encrypted. Which would probably leave you with doing c14n, validation
and decryption yourself. At which point I'd wonder why you'd need the
Shib SP in there at all and not just recieve (and process) the
assertion with your own code?
-peter