Help translating relying-party.xml from IdPv2 to v3

[Francesco Malvezzi]

Il 18/02/16 15:34, Cantor, Scott ha scritto:
>> my translation to IdPv3:
> 
> Lots of that are defaults, of course, so mostly superfluous.
> 
>> The problem is: response is signed, assertion is not.
>> 
>> I am quite sure the config is picked up because the nameID is set
>> to the strange format
>> (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified) required by
>> the legacy SP I am working with.
>> 
>> Where is the mistake?
> 
> Based on that alone, can't be true. So there's some other reason it's
> picking that NameID Format, but it can't be using that profile
> config. What does the log say on DEBUG about the
> RelyingPartyConfiguration ID it's using?
> 
> Note that the reverse is very possible, you can always leave
> assertion signing off but have an SP trigger it with
> WantAssertionsSigned in metadata (and in fact that's the better way
> than using an override, but you need the override anyway, because of
> the NameID). But your case, no, if it says to sign, it would.
> 
> As always, you should not assume "unspecified" is actually required.
> It rarely is, usually that means you can set it to anything (meaning
> to something correct).

Thank you for the detailed explanation. Now I am on a safer base,

Francesco