Shibboleth won't sign assertions?

[Cantor, Scott]

> OK, setting it to "true" worked for me.  The documentation here should
> probably be updated because it talks about "always":
> https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfigura
> tion#RelyingPartyConfiguration-Overrides

It's a wiki, anybody can change things. But where does it talk about that? I don't see it offhand yet, still looking. Needs to regardless, I don't think I covered those settings explicitly yet.

> But why do you probably want the response, and not the assertion, signed?

In this specific case it doesn't matter that much because encryption is off, but encryption is generally broken in XML unless the encrypted data is signed, so the best practice has been to sign the response for a while, at which point signing the assertion is unnecessary.

> As far as I can tell, SAML2 says that the "Issuer" is only mandatory inside the
> assertion element (inside the response, it's optional), and as that's what we
> need to be able to trust, surely it's the assertion that it's important be
> signed?

The assertion has to be protected, which can be done a number of different ways. Issuer is only optional in a response if it's not signed.

Signing the assertion is only relevant if the assertion is being repurposed as a delegation token, and that is an invalid thing to do with a SSO assertion when issued normally.

-- Scott