sign and/or encrypt SAML assetions, hack MITM

[Cantor, Scott]

> howerver, I still have a question regarding the overrides for that SP in
> relying-party.xml of my IDP, now I had to force " p:signAssertions="true"
> [1] in order for the SSO flow to succeed 

The proper option is "no, fix your SP". Signed responses are the proper mechanism.

> Isn't it the default behavior for the IDP to SignAssertions ? 

No, responses. Signed assertions create additional vectors of attack because sign-then-encrypt is known to be a flawed model, encrypt-then-sign (i.e. authenticated encryption) is the modern approach. The details are beyond the scope of this list.

Even if you wanted to sign the assertion, overrides are not how to do that (or anything else most of the time), the metadata is the best way to control that.

The SP has a rule: if you're using an override, you're doing it wrong. The IdP is not quite to that level but it's very close. It's almost never the best way to do something and hasn't been for many releases.

-- Scott