assertion not always signed

[Cantor, Scott]

On 1/13/17, 7:53 PM, "users on behalf of Tom Poage" <users-bounces at shibboleth.net on behalf of tfpoage at ucdavis.edu> wrote:

> Here's the original observation sent our way on the issue. IdP-initiated SSO. About a two-minute gap between logins (no
> IdP changes). Sorry, they're not complete assertions, cf. saml2p:Status.

You said no signature at all. I'm simply saying there will always be at least a response signature if it's set to do that, regardless of what triggers or doesn't trigger assertion signing.

As far as assertion signing is concerned, my answer remains the same, it will not change unless it's told to. If you're triggering the decision to sign with an override then one of the two requests involves a different entityID that doesn't apply the override (or there's something more unusual in play like two servers and a different configuration file on one of them).

-- Scott