WantsAssertionsSigned Property Not Validated By SP

[williwlwilliwll]

Whilst I'm testing my project I have noticed that the SP doesn't check if the IDP has signed the assertion in the SAMLResponse as per the SP's metadata.

Can you confirm if this is indeed the case, or have I made a mistake somewhere?

Thanks ❤️

Excerpt of Test

            return test.createSAMLRequest().then(({id, context}) => {
                return test.parseSAMLRequest(id, context);

            }).then((parsedSAMLRequest) => {
                return test.createSAMLResponse(parsedSAMLRequest);

            }).then(({ id, context: SAMLResponse }) => {
                // For the purpose of test, change the SP Metadata to require assertion signing;
                test.sp = ServiceProvider({
                    metadata: fs.readFileSync(`${__dirname}/signing-encryption/SAMLResponse/invalid_idp-doesnt-sign-assertions/sp_metadata-wantsigned.xml`),
                });
                return test.parseSAMLResponse(SAMLResponse);

            }).then((parsedSAMLResponse) => {
                const xmlRegex = /<saml:Assertion.*<ds:Signature xmlns:ds.*<\/ds:Signature>.*<\/saml:Assertion>/s;
                return expect(xmlRegex.test(parsedSAMLResponse.samlContent)).toBeFalsy();

            });

SP metadata at beginning of flow

<EntityDescriptor
 xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
 xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 entityID="http://localhost:3000/sso/metadata">
    <!-- SP doesn't expect IDP to sign assertions -->
    <SPSSODescriptor
    AuthnRequestsSigned="true"
    WantAssertionsSigned="false"
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <KeyDescriptor use="signing">

SP metadata at end of flow

<EntityDescriptor
 xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
 xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 entityID="http://localhost:3000/sso/metadata">
    <!-- SP expects IDP to sign assertions -->
    <SPSSODescriptor
    AuthnRequestsSigned="true"
    WantAssertionsSigned="true"
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <KeyDescriptor use="signing">
            <KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

[simoneiaconis]

I have the same problem, have you found any solution?

[williwlwilliwll]

@simoneiaconis Afraid not! I was only using the package's SP functionality for testing and in the end I had to give up on that particular test