InCommon metadata support

[Nick Roy <>]

After consulting with the Ops Advisory Group about Qualtrics' request
(they asked us to support this), it became apparent that this would
violate the MUST about support for signed assertions or responses in the
SAML 2 Web Browser SSO profile (with errata)

https://www.oasis-open.org/committees/download.php/22389/sstc-saml-profiles-errata-2.0-wd-07-diff.pdf

It was strongly recommended that we not support this metadata element.

Nick

On 4/13/18 4:01 PM, Andrew Morgan wrote:
> I'm working with a vendor (Qualtrics) that wants me to sign assertions in 
> SAML responses.  The Shibboleth IDP default is to sign responses, not 
> assertions.  I can override this in relying-party.xml easily, but I'd 
> prefer to avoid customizing my config.  The Shibboleth wiki says:
> 
>    If you need to enable the signAssertions option, and you control the
>    SP's metadata, you should generally add the WantAssertionsSigned flag to
>    it in place of using this option.
> 
> Is there any plan to support WantAssertionsSigned in the Federation 
> Manager?  Qualtrics is an InCommon member, and I get their metadata from 
> the InCommon aggregate.
> 
> Thanks,
> Andy Morgan
> Systems Administrator, Identity & Access Management
> Information Services | Oregon State University
> 541-737-8877 | is.oregonstate.edu
>