Signing of assertions

[Cantor, Scott]

On 11/9/16, 12:06 PM, "users on behalf of Roehrl Patrick" <users-bounces at shibboleth.net on behalf of patrick.roehrl at inet-logistics.com> wrote:

> On first login of a user at IdP the AuthnResponse and its Assertion gets both signed and the user gets successfully
> logged in. But when the application’s session expires and the user gets redirected to the IdP again (the session
> at the IdP is still active), then the IdP generates the AuthnResponse and signs the response but not the
> assertion….and then the login fails because our SP (no shibboleth SP) wants the assertion signed.

You have to be processing those requests as different relying party configurations, which means the two cases are being handled as different entityIDs, different metadata, etc. Until you fix that, the rest is academic. Probably the initial launch is IdP initiated and the other SP-initiated, and the entityIDs have to be different in each case.

> In the DefaultRelyingParty bean is set <bean parent="SAML2.SSO" p:signAssertions="true"/>. But it didn’t
> changed the behavior.

My second guess is that this is so screwed up you're mixing SAML versions on top of everything else.

> Does someone know what I am doing wrong? Is there another configuration which I didn’t found?

You have one completely fubar situation. Fix that, and the rest will fix itself.

-- Scott