<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p><span style="font-size: 12pt;">Hello, </span><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, Helvetica, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p><br>
</p>
<p>We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting is for SAML2.SSO (which I believe was <rp:ProfileConfiguration
xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.</p>
<p><br>
</p>
<p>I am following the following documents:</p>
<p>https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration </p>
<p>https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration</p>
<p>https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration</p>
<p><br>
</p>
<p>In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML Assertion is signed. Setting different values
for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted. </p>
<p><br>
</p>
<p>For instance,</p>
<p><bean parent="RelyingPartyByName" c:relyingPartyIds="..."></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><property name="profileConfigurations"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><list></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><bean parent="SAML2.SSO" p:signAssertions="true" /></p>
<p><br>
</p>
<p>results in a SAML response that is signed, for instance,</p>
<p><br>
</p>
<p><saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><saml2:Issuer>...</saml2:Issuer></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:SignedInfo></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>...</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span></ds:Signature></p>
<p> <saml2:Subject></p>
<p>...</p>
<p><br>
</p>
<p>on the other hand, setting signAssertions="false", </p>
<p><bean parent="RelyingPartyByName" c:relyingPartyIds="..."></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><property name="profileConfigurations"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><list></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><bean parent="SAML2.SSO" p:signAssertions="false" /></p>
<p><br>
</p>
<p>results in a SAML response that is not signed as intended, for instance,</p>
<p><saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><saml2:Subject></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>...</p>
<p><br>
</p>
<p>However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed: </p>
<p><saml2p:Response</p>
<p> Destination="..."</p>
<p> ID="_b2fd92278ee69708aeeed53011d02a2f"</p>
<p> InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"</p>
<p> IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"></p>
<p> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer></p>
<p> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"></p>
<p> <ds:SignedInfo></p>
<p> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></p>
<p> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/></p>
<p> <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f"></p>
<p> <ds:Transforms></p>
<p> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/></p>
<p> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></p>
<p> </ds:Transforms></p>
<p> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/></p>
<p> <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue></p>
<p> </ds:Reference></p>
<p> </ds:SignedInfo></p>
<p> <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue></p>
<p> <ds:KeyInfo></p>
<p> <ds:X509Data></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>...</p>
<p><br>
</p>
<p>Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:</p>
<p><saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><xenc:EncryptionMethod</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><xenc:EncryptedKey</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Id="_a0cd4ccff10277a60f2be39cf5ba2869"</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><xenc:EncryptionMethod</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:DigestMethod</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span></xenc:EncryptionMethod></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:KeyInfo></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:X509Data></p>
<p><span class="Apple-tab-span" style="white-space:pre"></span><ds:X509Certificate></p>
<p><br>
</p>
<p>Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations? </p>
<p><br>
</p>
<p>Thank you in advance,</p>
<p>Mitch </p>
<div><br>
</div>
</div>
</div>
</div>
</body>
</html>