Signing of assertions

[Roehrl Patrick]

Hello,

We've successfully updated from IdP V2.? to IdP V3.2.1, but now we found an issue in our setup:
On first login of a user at IdP the AuthnResponse and its Assertion gets both signed and the user gets successfully logged in.
But when the application's session expires and the user gets redirected to the IdP again (the session at the IdP is still active), then the IdP generates the AuthnResponse and signs the response but not the assertion....and then the login fails because our SP (no shibboleth SP) wants the assertion signed.

In the SP's metadata the flag WantAssertionsSigned is set to true.
Then I tried it with the RelyingParty configuration (like in https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration ).
In the DefaultRelyingParty bean is set <bean parent="SAML2.SSO" p:signAssertions="true"/>. But it didn't changed the behavior.
I also tried to override the profileConfigurations of the RelyingParty by its Id with <bean parent="SAML2.SSO" p:signAssertions="true"/>.  But it also didn't sign the assertion.
I also tried it with <bean parent="Shibboleth.SSO" p:signAssertions="true"/>...no success.

Does someone know what I am doing wrong? Is there another configuration which I didn't found?

Thanks for your help!

Greetz Patrick

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161109/9e281eb7/attachment.html>