Response to AttributeQuery is not signed

[Cantor, Scott]

On 9/16/16, 9:16 AM, "users on behalf of Roman CHRENKO" <users-bounces at shibboleth.net on behalf of Roman_CHRENKO at tempest.sk> wrote:

> Can you, please, suggest me, how to configure IDP to sign responses to AttributeQuery?

Not use TLS, or set the signResponses profile configuration setting for that profile. Signing is silly if TLS is used, and most uses of Shibboleth involve TLS with a self-signed certificate today, though that's something we'd like to change (well, not really, but it's necessary).

Message level security is a very poor substitute for TLS, but that's where things are headed, to the extent queries even remain relevant (they're mostly not anymore).

-- Scott