assertion signing defaults for IdP v3 vs v2

[Mark K. Miller]

I guess I'm still a bit uncertain what to make of all this, but it's 
reassuring to know I wasn't just dreaming up the differences.

Thank you, Scott!


On Thu, 18 Aug 2016, Cantor, Scott wrote:

>> First, do I just not have a clue, or did the defaults for assertion
>> signing change between v2 and v3.
>
> http://marc.info/?t=147134482600001&r=1&w=2
>
>> Obviously, this relates to an SP that is configured for signed assertions,
>> but isn't checking response signatures.
>
> If one is going to require one or the other, that's the wrong one to require. But nobody with a bug of that nature would have any hope of knowing any of reasons why, or care, so in effect, if you have that sort of bug, you've proven you shouldn't be implementing. It's useful as a signal of (in)competence.
>
>> Am I just too easily confused?  Did I just completely miss any
>> discussion/documentation about changing the signing defaults?
>
> I'll add it to the release notes.
>
> -- Scott
>
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>