Help translating relying-party.xml from IdPv2 to v3

[Cantor, Scott]

> my translation to IdPv3:

Lots of that are defaults, of course, so mostly superfluous.

> The problem is: response is signed, assertion is not.
> 
> I am quite sure the config is picked up because the nameID is set to the
> strange format (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)
> required by the legacy SP I am working with.
> 
> Where is the mistake?

Based on that alone, can't be true. So there's some other reason it's picking that NameID Format, but it can't be using that profile config. What does the log say on DEBUG about the RelyingPartyConfiguration ID it's using?

Note that the reverse is very possible, you can always leave assertion signing off but have an SP trigger it with WantAssertionsSigned in metadata (and in fact that's the better way than using an override, but you need the override anyway, because of the NameID). But your case, no, if it says to sign, it would.

As always, you should not assume "unspecified" is actually required. It rarely is, usually that means you can set it to anything (meaning to something correct).

-- Scott