Shibboleth won't sign assertions?

[Jeremy Morton]

OK, setting it to "true" worked for me.  The documentation here should
probably be updated because it talks about "always":
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-Overrides

But why do you probably want the response, and not the assertion, signed?
As far as I can tell, SAML2 says that the "Issuer" is only mandatory inside
the assertion element (inside the response, it's optional), and as that's
what we need to be able to trust, surely it's the assertion that it's
important be signed?

Best regards,
Jeremy Morton (Jez)

On Wed, Feb 4, 2015 at 4:29 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> You probably do *not* want assertions signed, most likely, you should sign
> responses.
>
> But "always" is a legacy config setting. For a non-legacy file, just set
> it to true if that's what you want. If you want the old "conditional"
> setting, that requires a bit more than just setting the value to
> conditional.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150204/5fb8ee8b/attachment.html