<div dir="ltr"><div><div>I&#39;m trying to override Shibboleth&#39;s default assertion signing behaviour.  I don&#39;t want assertions encrypted for my SP, but I do want them signed.  I have this config in relying-party.xml:<br><br>    &lt;util:list id=&quot;shibboleth.RelyingPartyOverrides&quot;&gt;<br>        &lt;bean parent=&quot;RelyingPartyByName&quot; c:relyingPartyIds=&quot;<a href="http://localhost:65231/">http://localhost:65231/</a>&quot;&gt;<br>            &lt;property name=&quot;profileConfigurations&quot;&gt;<br>                &lt;list&gt;<br>                    &lt;bean parent=&quot;SAML2.SSO&quot; p:encryptAssertions=&quot;false&quot; p:signAssertions=&quot;always&quot; /&gt;<br>                &lt;/list&gt;<br>            &lt;/property&gt;<br>        &lt;/bean&gt;<br>    &lt;/util:list&gt;<br><br></div>... where <a href="http://localhost:65231/">http://localhost:65231/</a> is identical to my EntityDescriptor entityID in metadata-providers.xml.  It seems to match, because assertions returned to that SP are no longer encrypted, by they are not signed either.  Only the overall response is signed.  Any ideas why the assertions are not signed?<br><br></div>Best regards,<br>Jeremy Morton (Jez)<br></div>