Shibboleth won't sign assertions?

[Jeremy Morton]

I'm trying to override Shibboleth's default assertion signing behaviour.  I
don't want assertions encrypted for my SP, but I do want them signed.  I
have this config in relying-party.xml:

    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName" c:relyingPartyIds="
http://localhost:65231/">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="always" />
                </list>
            </property>
        </bean>
    </util:list>

... where http://localhost:65231/ is identical to my EntityDescriptor
entityID in metadata-providers.xml.  It seems to match, because assertions
returned to that SP are no longer encrypted, by they are not signed
either.  Only the overall response is signed.  Any ideas why the assertions
are not signed?

Best regards,
Jeremy Morton (Jez)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150204/f731193f/attachment.html