Force SP to sign SOAP messages

[David Sommer]

Hi,

I want to force the SP to always sign SOAP messages sent via backchannel
for the HTTP-Artifact binding.

I used signing="true" in the ApplicationDefaults but the SP still sent
the message unsigned, so i suspected that this setting gets overridden
somewhere.
The login flow is initiated by a custom SessionInitiator and returns
back to the SP on a AssertionConsumerService using HTTP-Artifact binding.
However, the ArtifactResolve message sent out is unsigned.
I also tried to add signing="true" to the AssertionConsumerService (in
shibboleth2.xml), but that gave a parser error, even though
https://wiki.shibboleth.net/confluence/display/SP3/SAML+2.0+AssertionConsumerService
makes it look like this is actually allowed.

Cheers,

David