OpenSAML user discussion

[Nick Newman <>]

Hi,

I apologise in advance for yet another thread on this topic, but it
seems to be pretty confusing.

So, I have configured a SP to use OpenSAML to check SAML tickets
obtained from Shibboleth.

If I configure Shibboleth so that it doesn't encrypt the Assertion,
then I can validate the signature on the Assertion  and the signature
on the Response.  All is well.

If I configure Shibboleth to now encrypt the Assertion then I can
decrypt and then validate the signature on that Assertion, but then
the signature on the Response fails to validate.

That make it look as if decrypting the Assertion has changed the
Response object.  So to check this I checked the signature on the
Response both before and after decrypting the Assertion, and sure
enough the first one succeeded and the second failed.

So am I to understand from this that decrypting the Assertion does
something like replacing the EncryptedAssertion in the Response with
the "plain" Assertion?

Thanks,
Nick