<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Helvetica;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica">There are many reasons why your relying party override isn't working.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">The SP metadata could have WantResponseSigned or WantAssertionsSigned declared. Your relying party match could be incorrect. You may not have encryption set to optional.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">You could set logging to debug and check your logs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">I have many SSO profiles declared for relying parties and I have many combinations of p:signResponses="true" or "false" and p:signAssertions="true" or "false". You can set many properties on the same
profile in case you believe you are limited to one.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">It's not uncommon to see<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="SAML2.SSO" p:signAssertions="false" p:signResponses="true" p:encryptAssertions="false" /><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Good luck in your search.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Mitch Chang <mitch@sfu.ca><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, August 21, 2019 at 12:01 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="divtagdefaultwrapper">
<div id="divtagdefaultwrapper">
<p><span style="font-size:12.0pt;color:black">As you can see in my posted question, I've actually already tried that and it seems to make no difference. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Thanks,<o:p></o:p></span></p>
</div>
<div id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Mitch <o:p></o:p></span></p>
</div>
<div id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> users <users-bounces@shibboleth.net> on behalf of Mak, Steve <makst@upenn.edu><br>
<b>Sent:</b> August 21, 2019 4:16 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml</span><span style="font-size:12.0pt;color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:Helvetica;color:black">Try adding p:signResponses="false" to the relying party override you created.</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:Helvetica;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Mitch Chang <mitch@sfu.ca><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, August 21, 2019 at 12:36 AM<br>
<b>To: </b>"users@shibboleth.net" <users@shibboleth.net><br>
<b>Subject: </b>Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
</div>
<div id="divtagdefaultwrapper">
<p><span style="font-size:12.0pt;color:black">Hello, <o:p></o:p></span></p>
<div id="Signature">
<div id="divtagdefaultwrapper">
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting
is for SAML2.SSO (which I believe was <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">I am following the following documents:<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML
Assertion is signed. Setting different values for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted. <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">For instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="RelyingPartyByName" c:relyingPartyIds="..."><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><property name="profileConfigurations"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><list><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="SAML2.SSO" p:signAssertions="true" /><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">results in a SAML response that is signed, for instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Issuer>...</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"></ds:Signature><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <saml2:Subject><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">on the other hand, setting signAssertions="false", <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="RelyingPartyByName" c:relyingPartyIds="..."><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><property name="profileConfigurations"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><list><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><bean parent="SAML2.SSO" p:signAssertions="false" /><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">results in a SAML response that is not signed as intended, for instance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:Subject><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed: <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2p:Response<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> Destination="..."<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> ID="_b2fd92278ee69708aeeed53011d02a2f"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transforms><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:Transforms><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:Reference><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> </ds:SignedInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:KeyInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <ds:X509Data><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">...<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptionMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptedKey<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Id="_a0cd4ccff10277a60f2be39cf5ba2869"<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><xenc:EncryptionMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:DigestMethod<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"></xenc:EncryptionMethod><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:KeyInfo><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:X509Data><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"><ds:X509Certificate><o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations? <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Thank you in advance,<o:p></o:p></span></p>
<p><span style="font-size:12.0pt;color:black">Mitch <o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>