<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 05/05/2017 13:41, Peter Schober a
écrit :<br>
</div>
<blockquote cite="mid:20170505114129.GH8093@aco.net" type="cite">
<pre wrap="">* Jehan Procaccia <a class="moz-txt-link-rfc2396E" href="mailto:Jehan.Procaccia@it-sudparis.eu"><Jehan.Procaccia@it-sudparis.eu></a> [2017-05-05 10:32]:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionEnablement">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionEnablement</a>
</pre>
</blockquote>
<pre wrap="">I had already set in conf/idp.properties :
/idp.encryption.optional = false/
did I miss understood that boolean , I must be set to "true" to force saml
assertion to be signed ?
</pre>
</blockquote>
<pre wrap="">
You seem to have failed to read what is written exactly at the URL
Brent sent (and still is quoted above). In the example (e.g. the first
one called "Per-Profile Signing or Encryption Options") there are
custom relying party settings for your relying-party.xml, where you
can enable p:signAssertions="true".
Nowhere is there a mention of changing idp.properties for that.
And no, the property "idp.encryption.optional" has nothing to with
whether the IDP signs the SAML Response or the SAML Assertion.
It is about not encrypting (hence the name) data to an SP that does
not have a key suitable for encryption. (I.e., it's when you prefer to
end data not XML-encrypted to the SP rather than having the IDP fail
the transaction.)
-peter
</pre>
</blockquote>
Ok , that work fine now , I didn't noticed the "expanse Source" on
the above mention URL regarding <br>
<pre wrap="">SecurityConfiguration-SigningandEncryptionEnablement
</pre>
<br>
<div class="container" title="Hint: double-click to select code">
<div class="line number1 index0 alt2"><code class="xml comments"><!--
excerpt of relying-party.xml --></code></div>
<div class="line number2 index1 alt1"> </div>
<div class="line number3 index2 alt2"><code class="xml plain"><</code><code
class="xml keyword">bean</code> <code class="xml color1">parent</code><code
class="xml plain">=</code><code class="xml string">"RelyingPartyByName"</code>
<code class="xml color1">c:relyingPartyIds</code><code
class="xml plain">=</code><code class="xml string">"<a
href="https://sp.example.org" "=""><a class="moz-txt-link-freetext" href="https://sp.example.org">https://sp.example.org</a>"</a></code><code
class="xml plain">></code></div>
<div class="line number4 index3 alt1"><code class="xml spaces"> </code><code
class="xml plain"><</code><code class="xml keyword">property</code>
<code class="xml color1">name</code><code class="xml plain">=</code><code
class="xml string">"profileConfigurations"</code><code
class="xml plain">></code></div>
<div class="line number5 index4 alt2"><code class="xml spaces"> </code><code
class="xml plain"><</code><code class="xml keyword">list</code><code
class="xml plain">></code></div>
<div class="line number6 index5 alt1"><code class="xml spaces"> </code><code
class="xml plain"><</code><code class="xml keyword">bean</code>
<code class="xml color1">parent</code><code class="xml plain">=</code><code
class="xml string">"SAML2.SSO"</code> <code class="xml
color1">p:signAssertions</code><code class="xml plain">=</code><code
class="xml string">"true"</code> <code class="xml color1">p:encryptAssertions</code><code
class="xml plain">=</code><code class="xml string">"false"</code>
<code class="xml plain">/></code></div>
<div class="line number7 index6 alt2"><code class="xml spaces"> </code><code
class="xml plain"></</code><code class="xml keyword">list</code><code
class="xml plain">></code></div>
<div class="line number8 index7 alt1"><code class="xml spaces"> </code><code
class="xml plain"></</code><code class="xml keyword">property</code><code
class="xml plain">></code></div>
<div class="line number9 index8 alt2"><code class="xml plain"></</code><code
class="xml keyword">bean</code><code class="xml plain">><br>
</code><code class="xml string"><br>
<br>
</code>I set <code class="xml color1">signAssertions</code><code
class="xml plain">=</code><code class="xml string">"true"</code>
<code class="xml color1">p:encryptAssertions</code><code
class="xml plain">=</code><code class="xml string">"true" </code>,
and now lightsmal SP accept the now signed assertions. <br>
<br>
we have dozens of IDPs in our federation, it would be cumbersome
to ask each IDP mainteners to set this bean for that SP ,<br>
isn't there a global default setting to ask the IDP to sign
assertions in any case ? <br>
would it overload the saml echanges in a significant manner? <br>
<br>
thanks .<br>
<br>
</div>
</div>
</body>
</html>