<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:inherit;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Likely a minor point in this case, but service providers should be looking for signed responses rather than signed assertions, according to the Kantara SAML 2.0 federation interoperability specification [1].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">See requirement IIP-SP13:<o:p></o:p></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt">
“<span style="font-size:12.0pt;font-family:"inherit",serif;letter-spacing:-.1pt">Service Providers MUST support the ability to reject unsigned</span><span class="apple-converted-space"><span style="font-size:12.0pt;font-family:"inherit",serif;letter-spacing:-.1pt"> </span></span><code><span style="font-size:11.5pt;color:black;background:#F7F7F8"><samlp:Response></span></code><span class="apple-converted-space"><span style="font-size:12.0pt;font-family:"inherit",serif;letter-spacing:-.1pt"> </span></span><span style="font-size:12.0pt;font-family:"inherit",serif;letter-spacing:-.1pt">elements
and SHOULD do so by default.</span>”<span style="font-size:12.0pt;font-family:"inherit",serif;letter-spacing:-.1pt"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[1] https://kantarainitiative.github.io/SAMLprofiles/fedinterop.html<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of "Lohr, Donald" <lohrda@jmu.edu><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Tuesday, June 9, 2020 at 3:05 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>IDP signs the SAML Assertion<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in">I've a SP vendor asking:<br>
<br>
<i>Are you able to go in to your identity provider, go to the service provider configuration, and ensure that the IDP signs the SAML Assertion?<br>
</i><br>
How can I actually prove this or not prove it?<br>
<br>
Don<br>
<br>
<o:p></o:p></p>
<pre style="margin-left:.5in">-- <o:p></o:p></pre>
<pre style="margin-left:.5in">D o n a l d L o h r<o:p></o:p></pre>
<pre style="margin-left:.5in">I n f o r m a t i o n S y s t e m s<o:p></o:p></pre>
<pre style="margin-left:.5in">J a m e s M a d i s o n U n i v e r s i t y<o:p></o:p></pre>
<pre style="margin-left:.5in">5 4 0 . 5 6 8 . 3 7 3 0<o:p></o:p></pre>
</div>
</body>
</html>