signed responses from an IdP

[Cantor, Scott]

On 8/17/15, 3:51 PM, "users on behalf of Mark K. Miller" <users-bounces at shibboleth.net on behalf of max at psu.edu> wrote:

>Why is the default on my Shibboleth Idp "never"?

See http://marc.info/?t=143752159100001&r=1&w=2

>  And, would anyone know 
>what to change on the Ping Identity side to make this work the way it used 
>to?

Signing the response is current best practice anyway, but I can't tell you the settings on the Ping side. The main reason to require a signed response is preventing attacks against XML Encryption, but I'm sure that isn't why they're requiring it.

-- Scott