assertion not always signed

[Cantor, Scott]

On 1/13/17, 7:13 PM, "users on behalf of Les LaCroix" <users-bounces at shibboleth.net on behalf of llacroix at carleton.edu> wrote:

> I have compared the SAML responses between failing and working attempts, using the SAML Chrome Panel.  To my eye,
> the only significant difference in responses is that the assertion is signed when things work and is not signed when things
> do not work.

The IdP doesn't randomly decide. If the metadata contains the flag saying to sign them, or if there's an override in place changing that profile setting, then it signs. Otherwise the default is not to. That's all. So the answer is that they are relying on different entityIDs/metadata that is driving different behavior.
 
> For us the signature is completely missing.

That is impossible unless you also turned off response signing, or unless it was returning a SAML error to the SP and you told it not to sign errors.

-- Scott