<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 1/23/17 4:55 PM,
<a class="moz-txt-link-abbreviated" href="mailto:shibboleth655@lewenberg.com">shibboleth655@lewenberg.com</a> wrote:<br>
</div>
<blockquote
cite="mid:3ebc52b5-9978-87d9-405c-d39716bf798a@stanford.edu"
type="cite"><br>
What does "conditional" mean for each of the three settings
(signResponses, signAssertions, encryptAssertions) in the context
of SAML2SSOProfile?
<br>
</blockquote>
<br>
Well, conditional = "required only if the transport/encoding level
doesn't provide them", which means whether you already have
end-to-end message integrity and/or confidentiality between the IdP
and SP. Since for front-channel SAML bindings like SAML 2 SSO you
never do by definition, due to the user's browser acting as
intermediary, "conditional" will effectively be the same as
"always".<br>
<br>
Where you'd see a practical difference is say on a direct
back-channel request, like an attribute query from the SP to the IdP
(which is not typical in SAML 2) via SOAP over HTTP. There a
connection via TLS (HTTPS) would satisfy the integrity and
confidentiality conditional, as where plain non-TLS HTTP would not.<br>
<br>
</body>
</html>