How can I keep SAML assertion in SP?

[Paolo Mosconi]

> You probably don't have the cacheAssertions flag on.

It is set to true, and I can see assertions are present in memcache.


> That's not a valid use case for a SSO assertion, so that's not appropriate, as I said. It's literally a security violation under the standard, as the assertion is not valid for that purpose or that audience. It's a one-time use bearer token with a very short lifetime to limit people from doing exactly this.

The service is going to receive the user attributes and the assertion that, as far as I understood is just going to be stored for reference to attest the user was valid at the time of signon.
Why you believe it is a standard violation?

Paolo Mosconi
paolo.mosconi at actvalue.com

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: lunedì 30 gennaio 2023 13:54
To: Paolo Mosconi <paolo.mosconi at actvalue.com>; Shib Users <users at shibboleth.net>
Subject: Re: How can I keep SAML assertion in SP?

You probably don't have the cacheAssertions flag on.

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334652/StorageServiceSessionCache

> A 3rd party external service needs the assertion to create a one time 
> signing certificate for authenticated users: theirs specs, nothing I can do about.

That's not a valid use case for a SSO assertion, so that's not appropriate, as I said. It's literally a security violation under the standard, as the assertion is not valid for that purpose or that audience. It's a one-time use bearer token with a very short lifetime to limit people from doing exactly this.

-- Scott