<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Try p:signAssertions=“true”. That worked for me on IdP 3.0</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Jeremy Morton <<a href="mailto:jez9999@gmail.com">jez9999@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, February 4, 2015 at 11:18 AM<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Shibboleth won't sign assertions?<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>
<div>I'm trying to override Shibboleth's default assertion signing behaviour. I don't want assertions encrypted for my SP, but I do want them signed. I have this config in relying-party.xml:<br>
<br>
<util:list id="shibboleth.RelyingPartyOverrides"><br>
<bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://localhost:65231/">http://localhost:65231/</a>"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO" p:encryptAssertions="false" p:signAssertions="always" /><br>
</list><br>
</property><br>
</bean><br>
</util:list><br>
<br>
</div>
... where <a href="http://localhost:65231/">http://localhost:65231/</a> is identical to my EntityDescriptor entityID in metadata-providers.xml. It seems to match, because assertions returned to that SP are no longer encrypted, by they are not signed either.
Only the overall response is signed. Any ideas why the assertions are not signed?<br>
<br>
</div>
Best regards,<br>
Jeremy Morton (Jez)<br>
</div>
</div>
</div>
</span>
</body>
</html>