[ https://issues.jboss.org/browse/SRAMP-436?page=com.atlassian.jira.plugin.... ] Eric Wittmann commented on SRAMP-436: ------------------------------------- Note: the saml bearer token auth technique *is* signing the assertions by default. But the SSO doesn't sign its assertion prior to returning it to the SP. And the SP doesn't check for a sig. Both of these need to be fixed. I anticipate that a resulting challenge will be how to configure the path to the keystore. Perhaps we can have custom versions of the servlet filters which can do platform-specific searching for it. -- This message was sent by Atlassian JIRA (v6.2.3#6260)