what controls assertion signing?

[Cantor, Scott]

> Yeah, but in general I'd expect to be able to change my IDP's
> behaviour by changing its configuration, not having to modify
> incoming metadata before it hits my IDP (with all the issues that come
> from that).

I understand the reasoning, I'm just saying it's always been that way. And I can provide that optionality now.

> As for that specific signalling (the SP is likely saying it can only
> process this or that type of signing) there's probably no harm in
> letting metadata overrule.

That's the point of the setting, it's an error prevention thing.

-- Scott