assertion not always signed

[Tom Poage]

> On Jan 13, 2017, at 4:29 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
...
>> 
>> For us the signature is completely missing.
> 
> That is impossible unless you also turned off response signing, or unless it was returning a SAML error to the SP and you told it not to sign errors.

Here's the original observation sent our way on the issue. IdP-initiated SSO. About a two-minute gap between logins (no IdP changes). Sorry, they're not complete assertions, cf. saml2p:Status.

Response when not logged in (has signature):
 
        </saml2p:Status>
               <saml2:Assertion ID="_8cebf48a58f6cf402cedc7d99bb4d7b0"
                                IssueInstant="2016-11-23T18:28:11.924Z"
                                Version="2.0"
                                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                                >
                               <saml2:Issuer>urn:mace:incommon:ucdavis.edu</saml2:Issuer>
                               <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                                              <ds:SignedInfo>
                                                             <ds:CanonicalizationMethod ... />
                                                             <ds:SignatureMethod ... />
                                                             <ds:Reference URI="#_8cebf48a58f6cf402cedc7d99bb4d7b0">
                                                                             <ds:Transforms>
                                                                                    <ds:Transform ...
                                                                                    <ds:Transform ... />
                                                                             </ds:Transforms>
                                                                             <ds:DigestMethod ... />
                                                                             <ds:DigestValue>...</ds:DigestValue>
                                                             </ds:Reference>
                                              </ds:SignedInfo>
                                              <ds:SignatureValue>
f8mOO7cDxDvCpTTA5xY6QeVLuwiUujwHc/KXCQQW/G5XbN8F8aqtGj6tnM0p4nojwsvODqEJFguG
...
 
 
Subsequent assertion (NameID populated, but no assertion signature).
 
               <saml2:Assertion ID="_628125dd68e6cef696dcf249531ef859"
                                IssueInstant="2016-11-23T18:30:21.367Z"
                                Version="2.0"
                                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                                >
                               <saml2:Issuer>urn:mace:incommon:ucdavis.edu</saml2:Issuer>
                               <saml2:Subject>
                                              <saml2:NameID Format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                                                            NameQualifier="urn:mace:incommon:ucdavis.edu"
                                                            SPNameQualifier="https://xxxxxxx.kronos.net"
                                                            xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                                                            >XXXXXXX at ucdavis.edu</saml2:NameID>
                                              <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                                                             <saml2:SubjectConfirmationData Address="..."
                                                                                            NotOnOrAfter="2016-11-23T18:35:21.370Z"
Recipient="https://xxxxxx.kronos.net/wfc/logonWithUID"
/>
                                              </saml2:SubjectConfirmation>
                               </saml2:Subject>
                               <saml2:Conditions NotBefore="2016-11-23T18:30:21.367Z"
                                                 NotOnOrAfter="2016-11-23T18:35:21.367Z"
                                                 >
                                              <saml2:AudienceRestriction>
                                                             <saml2:Audience>https://xxxxxxx.kronos.net</saml2:Audience>
                                              </saml2:AudienceRestriction>
                               </saml2:Conditions>
                               <saml2:AuthnStatement AuthnInstant="2016-11-23T18:28:11.899Z"
                                                     SessionIndex="_da5d901bf64cf61b414bd5597edddff9"
                                                     >
                                              <saml2:SubjectLocality Address="..." />
                                              <saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
                                              </saml2:AuthnContext>
                               </saml2:AuthnStatement>
               </saml2:Assertion> 

Tom.