How can I keep SAML assertion in SP?

[Cantor, Scott]

You probably don't have the cacheAssertions flag on.

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334652/StorageServiceSessionCache

> A 3rd party external service needs the assertion to create a one time signing
> certificate for authenticated users: theirs specs, nothing I can do about.

That's not a valid use case for a SSO assertion, so that's not appropriate, as I said. It's literally a security violation under the standard, as the assertion is not valid for that purpose or that audience. It's a one-time use bearer token with a very short lifetime to limit people from doing exactly this.

-- Scott