Shibboleth won't sign assertions?

[Cantor, Scott]

> So where is the profile specification?

All of the standards documents are posted on the OASIS wiki [1].

I'm not sure what this point about "Issuer" has to do with the original question. As a technical matter, the SSO profile was designed to support signing only the assertion for historical reasons. If you're trying to demonstrate that, you don't have to, I'm well aware of it. For practical reasons that have emerged long since then, it is not a best practice to do so.

-- Scott

[1] https://wiki.oasis-open.org/security/