New relying party config

[Michael A Grady]

I've been looking more closely at the new v3 relying party config. And I want to be sure I understand the distinction between the settings that the System Profile Defaults section in:

  https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

have with the added 'Predicate' string and an 'alwaysFalse' or 'alwaysTrue' type value versus those settings that are just true/false. E.g 
   signAssertionsPredicate = alwaysFalse  
     versus something like
   includeConditionsNotBefore = true
   
I've seen examples just showing p:signAssertions="false", what's the difference between the latter and the form with the Predicate? And what is the potential value set for those with Predicate, because there is even the example in that section of:

   signResponsesPredicate = if TLS isn't used or port 443 is used

I'd also like to confirm if I'm reading this documentation correctly. In Shib v2 (at least for SAML2SSO), signResponses was never and signAssertions was always, but it appears that the defaults in v3 have signResponses as true and signAssertions as false. Is that correct?

Finally, if one had a profile with 'signResponses="conditional"' before, what is the equivalent in v3 -- just setting that to 'true', since in most cases, conditional was effectively true before?

--
Michael A. Grady
IAM Architect, Unicon, Inc.