<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:Helvetica;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica">Try adding p:signResponses="false" to the relying party override you created.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Mitch Chang <mitch@sfu.ca><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, August 21, 2019 at 12:36 AM<br>
<b>To: </b>"users@shibboleth.net" <users@shibboleth.net><br>
<b>Subject: </b>Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="divtagdefaultwrapper">
<p><span style="font-size:12.0pt;color:black">Hello, <o:p></o:p></span></p>
<div id="Signature">
<div id="divtagdefaultwrapper">
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting
is for SAML2.SSO (which I believe was <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">I am following the following documents:<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML
Assertion is signed. Setting different values for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted. <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">For instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="RelyingPartyByName" c:relyingPartyIds="..."><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><property name="profileConfigurations"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><list><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="SAML2.SSO" p:signAssertions="true" /><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">results in a SAML response that is signed, for instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Issuer>...</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"></ds:Signature><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <saml2:Subject><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">on the other hand, setting signAssertions="false", <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="RelyingPartyByName" c:relyingPartyIds="..."><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><property name="profileConfigurations"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><list><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="SAML2.SSO" p:signAssertions="false" /><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">results in a SAML response that is not signed as intended, for instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Subject><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed: <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2p:Response<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> Destination="..."<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> ID="_b2fd92278ee69708aeeed53011d02a2f"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transforms><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:Transforms><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:Reference><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:KeyInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:X509Data><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptionMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptedKey<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Id="_a0cd4ccff10277a60f2be39cf5ba2869"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptionMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:DigestMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"></xenc:EncryptionMethod><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:KeyInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:X509Data><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:X509Certificate><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations? <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Thank you in advance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Mitch <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>