What does "conditional" mean in SAML2SSOProfile?

[Brent Putman]

On 1/23/17 4:55 PM, shibboleth655 at lewenberg.com wrote:
>
> What does "conditional" mean for each of the three settings
> (signResponses, signAssertions, encryptAssertions) in the context of
> SAML2SSOProfile?

Well, conditional = "required only if the transport/encoding level
doesn't provide them", which means whether you already have end-to-end
message integrity and/or confidentiality between the IdP and SP.  Since
for front-channel SAML bindings like SAML 2 SSO you never do by
definition, due to the user's browser acting as intermediary,
"conditional" will effectively be the same as "always".

Where you'd see a practical difference is say on a direct back-channel
request, like an attribute query from the SP to the IdP (which is not
typical in SAML 2) via SOAP over HTTP.  There a connection via TLS
(HTTPS) would satisfy the integrity and confidentiality conditional, as
where plain non-TLS HTTP would not.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170123/8c0fa458/attachment.html>