assertion not always signed

[Rich Graves]

> If you're triggering the decision to sign with an override then one of the two requests involves
> a different entityID that doesn't apply the override (or there's something more unusual in play
> like two servers and a different configuration file on one of them).

Just one server, pretty simple. What knob in logback.xml would be best
to trace that?

The metadata and default and specific relying-party look
straightforward. We have no exceptions defined by criteria other than
RelyingPartyByName. We told the Microsoft end to use HTTP-POST
binding. For want of a cat to swing around at midnight, I guess we
could reconfigure the Office365 end to use HTTP-Redirect and see if
things improve?

    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <!--
https://wiki.shibboleth.net/confluence/display/IDP30/ConsentConfiguration#ConsentConfiguration-DisablingAttributeReleaseConsent
-->
                <bean parent="SAML2.SSO"
p:postAuthenticationFlows="geoip-check,expiring-password,attribute-release"
     p:nameIDFormatPrecedence="#{{
            'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
            'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' }}" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="CAS.LoginConfiguration" />
                <ref bean="CAS.ProxyConfiguration" />
                <ref bean="CAS.ValidateConfiguration" />
                <!-- <ref bean="SAML2.AttributeQuery" /> -->
                <!-- <ref bean="SAML2.ArtifactResolution" /> -->
            </list>
        </property>
    </bean>

<bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">
    <property name="profileConfigurations">
        <list>
            <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false" />
            <bean parent="SAML2.ECP" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
/>
        </list>
    </property>
</bean>