<div dir="ltr"><div><div>I can confirm that there's no line break in the actual metadata file, so it must have been an artifact of the email. And there is a signing key present, I just redacted it.<br><br></div>Can you elaborate on the difference (as it relates to Shiboleth) between encrypting the response vs signing the response?<br><br></div>I have the following in my relying-party.xml:<br><br><font size="1"><span style="font-family:monospace,monospace"><rp:DefaultRelyingParty provider="<a href="https://shib.tc.columbia.edu/idp/shibboleth">https://shib.tc.columbia.edu/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential"><br> <!-- <br> Each attribute in these profiles configuration is set to its default value,<br> that is, the values that would be in effect if those attributes were not present.<br> We list them here so that people are aware of them (since they seem reluctant to <br> read the documentation).<br> --><br> <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"<br> includeAttributeStatement="false"<br> assertionLifetime="PT5M"<br> signResponses="always"<br> signAssertions="always"<br> includeConditionsNotBefore="true"/><br> <br> <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"<br> assertionLifetime="PT5M"<br> signResponses="always"<br> signAssertions="always"<br> includeConditionsNotBefore="true"/><br> <br> <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile"<br> signResponses="always"<br> signAssertions="always"/><br> <br> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"<br> includeAttributeStatement="true"<br> assertionLifetime="PT5M"<br> assertionProxyCount="0"<br> signResponses="always"<br> signAssertions="always"<br> encryptAssertions="conditional"<br> encryptNameIds="never"<br> includeConditionsNotBefore="true"/><br><br> <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"<br> includeAttributeStatement="true"<br> assertionLifetime="PT5M"<br> assertionProxyCount="0"<br> signResponses="always"<br> signAssertions="always"<br> encryptAssertions="conditional"<br> encryptNameIds="never"<br> includeConditionsNotBefore="true"/><br><br> <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" <br> assertionLifetime="PT5M"<br> assertionProxyCount="0"<br> signResponses="always"<br> signAssertions="always"<br> encryptAssertions="conditional"<br> encryptNameIds="never"<br> includeConditionsNotBefore="true"/><br> <br> <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" <br> signResponses="always"<br> signAssertions="always"<br> encryptAssertions="conditional"<br> encryptNameIds="never"/><br> <br> <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"<br> signResponses="always"/><br><br></rp:DefaultRelyingParty></span></font><br><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">From your comment, I'm assuming that the use="signing" restriction means that the key can only be used for signing the requests/assertions and not encrypting it. I see above that I have encryptAssertions="conditional" (<font size="1"><span style="font-family:monospace,monospace">saml:SAML2ECPProfile</span></font>). What determines this conditional behavior? Can I just remove the "signing" restriction?<br><br></div><div class="gmail_quote">Thank you!<br></div><div class="gmail_quote">Teddy<br></div><div class="gmail_quote"><br>On Wed, Mar 11, 2015 at 9:56 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">On 3/11/15, 5:31 AM, "Peter Schober" <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
<br>
>* Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> [2015-03-11 02:31]:<br>
>> On 3/11/15, 1:22 AM, "Sacilowski, Tadeusz" <<a href="mailto:ts2878@tc.columbia.edu">ts2878@tc.columbia.edu</a>> wrote:<br>
>> >This is the metadata generated by ServiceNow (referenced above):<br>
>><br>
>> Which has no key in it.<br>
><br>
>To add a bit verbosity to that: The metadata has no key usable for<br>
>encryption in it (note the use="signing" restriction).<br>
<br>
</span>If there was a signing key, I missed that, but same difference, yes.<br>
<span class=""><font color="#888888"><br>
-- Scott<br>
</font></span><div class=""><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><b>Tadeusz Sacilowski</b><div><i>Manager, Portal & Mobile Development</i></div><div>Teachers College, Columbia University</div><div><a href="mailto:sacilowski@tc.columbia.edu" target="_blank">sacilowski@tc.columbia.edu</a></div></div></div>
</div></div></div></div></div>