OpenSAML user discussion

[Scott Cantor <>]

Another point I'd make about your example instance is that it won't work
anyway. You're doing the one thing you can't do in SAML 1.0 interoperably,
which is to sign an assertion and stick it inside something else, in this
case a response. Your Reference URI is bogus because it's pointing at the
whole document, not the Assertion.

I don't build any signature transfoms that would work in that case, which
requires Xpath, basically.

Signing the response itself should work, subject to whether there are
problems I mentioned before in C++, but the assertion part definitely won't.

-- Scott