amergey commented on pull request #54: URL: https://github.com/apache/cxf-fediz/pull/54#issuecomment-644625040
> I think that "doNotEnforceAssertionsSigned" should only apply to encrypted assertions. I don't see a use-case for supporting unsigned and unencrypted assertions. Then maybe the doNotEnforceAssertionSigned in configuration is not necessary at all and replace its "logic" with checks to the token and disable assertion signature check when assertion is crypted and unsigned. What do you think ? ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
