does Mellon require a signed assertion? about mod_auth_mellon HOT 3 CLOSED

Hello,
You can add AuthnRequestsSigned="true" and WantAssertionsSigned="true" on SPSSODescriptor.

Exemple ;
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">

from mod_auth_mellon.

HI

Thank you for the reply! I tried flipping that from true to false and I got the same error. Want to make sure I understand how it works - setting WantAssertionsSigned tells the mellon module that the IdP's assertion will not be signed, or does it tell the IdP not to sign the assertion?

from mod_auth_mellon.

The verification of the message signature is handled by the Lasso library that Mellon builds on. Lasso will verify the response signature, if it's missing, it will see if the assertion is signed and verify that. For more details I refer you to the Lasso project.

from mod_auth_mellon.