signature not found

[Tom Poage]

> On Jan 13, 2017, at 4:27 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 1/13/17, 7:20 PM, "users on behalf of Tom Poage" <users-bounces at shibboleth.net on behalf of tfpoage at ucdavis.edu> wrote:
>> Here's what we ended up with:
> 
> All you need to do is edit their metadata, which I imagine you loaded yourself, to include the WantAssertionsSigned flag.
> 
> Using overrides should always be the last resort, the metadata the first.

So I tried Kronos w/ WantAssertionsSigned="true" in metadata for their SP, removing the relying party override mentioned earlier, cf.

<bean parent="SAML2.SSO"
      p:encryptAssertions="false"
      p:signAssertions="true"
      p:signResponses="false"/>

There is a difference in the SAML Response, but it also doesn't appear to matter.

The difference is Kronos told us to disable response signature and enable assertion signature. Setting WantAssertionsSigned="true" without the relying party override signs both response and assertion (looks like the only way in the IdP to disable response signature is via relying party override).

Anyhow, SSO proceeds without error, so WantAssertionsSigned="true" in metadata alone is sufficient for this app. Whether they validate reponse signature or ignore it is not known.

Tom.