Missing authn request signature

[Peter Schober]

* Paolo Smiraglia <paolo.smiraglia at gmail.com> [2018-06-12 11:40]:
> Recently I realised that, despite "signing=true", the AuthN requests
> are not signed. This is the template that I use to generate the
> shibboleth2.xml file
> 
>    https://github.com/italia/spid-auth-docker/blob/master/etc/shibboleth/shibboleth2.xml.tpl
> 
> Could you check if there is something wrong? Many thanks!

You mean besides loading remote SAML Metadata without performing
signature validation? ;)

You've changed the default location for the SAML key pair:

<CredentialResolver type="File"
  key="/opt/shibboleth-sp/certs/sp-key.pem"
  certificate="/opt/shibboleth-sp/certs/sp-cert.pem"

The software will generate a key pair from the RPM spec file but that
will end up in /etc/shibboleth. I don't see you moving this to the
specifified location above (e.g. in the Dockerfile) and it's not
obvious to me that some other process puts a key pair there?
Your README tells people to pu a key pair in
/opt/authproxy/certs/saml/ which doesn't match the configured location
either (unless you're doing some Docker mounting, I haven't checked).

But if the above were in fact the source of the error the SP should
complain loudly during startup about a missing key pair, AFAIR.
Did you check the logs?

-peter