Help translating relying-party.xml from IdPv2 to v3

[Francesco Malvezzi]

I really need some help to actualize a relying-party.xml fragment.

Working IdPv2 version is:

<RelyingParty id="https://example-sp.com/gw/metadata"
                         provider="https://example.edu/idp/shibboleth"
                         defaultSigningCredentialRef="IdPCredential">
        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                              includeAttributeStatement="true"
                              assertionLifetime="PT5M0.000S"
                              assertionProxyCount="0"
                              signResponses="always"
                              signAssertions="always"
                              encryptAssertions="never"
                              encryptNameIds="never" />

my translation to IdPv3:

        <bean id="shibboleth.exampleSPParty" parent="RelyingParty">
            <property name="activationCondition"
                      ref="shibboleth.exampleSPPartyPredicate" />
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"

p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}"
                          p:includeAttributeStatement="true"
                          p:assertionLifetime="PT5M0.000S"
                          p:proxyCount="0"
                          p:encryptAssertions="false"
                          p:signResponses="true"
                          p:signAssertions="true"
                          p:encryptNameIDs="false"
                          p:postAuthenticationFlows="#{ {'terms-of-use',
'attribute-release'} }" />
                </list>
            </property>
        </bean>

(the shibboleth.exampleSPPartyPredicate resolves to the same SP entityID)

The problem is: response is signed, assertion is not.

I am quite sure the config is picked up because the nameID is set to the
strange format (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)
required by the legacy SP I am working with.

Where is the mistake?

thank you,

Francesco