<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
On 2/29/12 12:16 AM, Sharma, Dattathreya wrote:
<blockquote
cite="mid:0A3F5E9A7373D5439C6A94F2DD86BF360E908C@EM1C.ad.ucla.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;"><br>
<div><br>
</div>
<div>I looked at the raw xml response from the IdP. Signature
( <ds:Signature> element) is nested
inside <saml2:Assertion>. Is it possible to have
Signature outside the Assertion? <br>
</div>
</div>
</blockquote>
<br>
<br>
Yes, see:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPXMLSigEnc">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPXMLSigEnc</a><br>
<br>
<br>
Change signResponses to "always" or "conditional" and signAssertions
to "never", for the relevant ProfileConfiguration within the
relevant RelyingParty.<br>
</body>
</html>