diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorRequest.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorRequest.java
index 05178bb..ec6c2c3 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorRequest.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorRequest.java
@@ -28,6 +28,7 @@
 
     private final Element token;
     private final Certificate[] certs;
+    private boolean enforceTokenSigned = true;
 
     public TokenValidatorRequest(Element token, Certificate[] certs) {
         this.token = token;
@@ -48,7 +49,12 @@
         }
         return null;
     }
-
-
-
+    
+    public void setEnforceTokenSigned(boolean enforceTokenSigned) {
+        this.enforceTokenSigned = enforceTokenSigned;
+    }
+    
+    public boolean isEnforceTokenSigned() {
+        return this.enforceTokenSigned;
+    }
 }
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
index c552ef5..41be398 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
@@ -53,11 +53,23 @@
     }
 
     public boolean isSignRequest() {
-        return getSAMLProtocol().isSignRequest();
+        if (getSAMLProtocol().getSignRequest() != null) {
+            return getSAMLProtocol().getSignRequest().isValue();
+        } else {
+            return false;
+        }
+    }
+    
+    public SignatureDigestAlgorithm getSignRequestAlgorithm() {
+        if (getSAMLProtocol().getSignRequest() != null && getSAMLProtocol().getSignRequest().getAlgorithm() != null) {
+            return SignatureDigestAlgorithm.fromValue(getSAMLProtocol().getSignRequest().getAlgorithm().value());
+        }
+        
+        return SignatureDigestAlgorithm.RSA_SHA1;
     }
 
     public void setSignRequest(boolean signRequest) {
-        getSAMLProtocol().setSignRequest(signRequest);
+        getSAMLProtocol().getSignRequest().setValue(signRequest);
     }
 
     public SAMLPRequestBuilder getSAMLPRequestBuilder() {
@@ -103,6 +115,10 @@
     public boolean isDoNotEnforceKnownIssuer() {
         return getSAMLProtocol().isDoNotEnforceKnownIssuer();
     }
+    
+    public boolean isDoNotEnforceEncryptedAssertionsSigned() {
+        return getSAMLProtocol().isDoNotEnforceEncryptedAssertionsSigned();
+    }
 
     public void setDoNotEnforceKnownIssuer(boolean doNotEnforceKnownIssuer) {
         getSAMLProtocol().setDoNotEnforceKnownIssuer(doNotEnforceKnownIssuer);
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SignatureDigestAlgorithm.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SignatureDigestAlgorithm.java
new file mode 100644
index 0000000..c6a936f
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SignatureDigestAlgorithm.java
@@ -0,0 +1,53 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.config;
+
+import org.apache.cxf.fediz.core.config.jaxb.SignatureDigestAlgorithmType;
+
+public enum SignatureDigestAlgorithm {
+
+    RSA_SHA1("RSA_SHA1"),
+    RSA_SHA256("RSA_SHA256");
+
+    private final String value;
+
+    SignatureDigestAlgorithm(String v) {
+        value = v;
+    }
+    SignatureDigestAlgorithm(SignatureDigestAlgorithmType type) {
+        value = type.value();
+    }
+
+    public String value() {
+        return value;
+    }
+
+    public static SignatureDigestAlgorithm fromValue(String v) {
+        for (SignatureDigestAlgorithm c: SignatureDigestAlgorithm.values()) {
+            if (c.value.equals(v)) {
+                return c;
+            }
+        }
+        throw new IllegalArgumentException(v);
+    }
+
+
+
+}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
index 08af3d7..3b40248 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
@@ -213,6 +213,11 @@
                 try {
                     TokenValidatorRequest validatorRequest =
                         new TokenValidatorRequest(token, request.getCerts());
+                    boolean doNotEnforceAssertionsSigned =
+                            ((SAMLProtocol)config.getProtocol()).isDoNotEnforceEncryptedAssertionsSigned()
+                            && !((org.opensaml.saml.saml2.core.Response)responseObject).getEncryptedAssertions()
+                            .isEmpty();
+                    validatorRequest.setEnforceTokenSigned(!doNotEnforceAssertionsSigned);
                     validatorResponse = validator.validateAndProcessToken(validatorRequest, config);
                 } catch (ProcessingException ex) {
                     throw ex;
@@ -440,7 +445,12 @@
             ssoResponseValidator.setIssuerIDP(requestState != null ? requestState.getIdpServiceAddress() : null);
             ssoResponseValidator.setRequestId(requestState != null ? requestState.getRequestId() : null);
             ssoResponseValidator.setSpIdentifier(requestState != null ? requestState.getIssuerId() : null);
-            ssoResponseValidator.setEnforceAssertionsSigned(true);
+            
+            boolean doNotEnforceAssertionsSigned =
+                    ((SAMLProtocol)config.getProtocol()).isDoNotEnforceEncryptedAssertionsSigned()
+                    && !samlResponse.getEncryptedAssertions().isEmpty();
+            ssoResponseValidator.setEnforceAssertionsSigned(!doNotEnforceAssertionsSigned);
+            
             ssoResponseValidator.setReplayCache(config.getTokenReplayCache());
 
             return ssoResponseValidator.validateSamlResponse(samlResponse, false);
@@ -572,6 +582,19 @@
         if (privateKey.getAlgorithm().equalsIgnoreCase("DSA")) {
             sigAlgo = WSConstants.DSA;
             jceSigAlgo = "SHA1withDSA";
+        } else {
+            switch(((SAMLProtocol)config.getProtocol()).getSignRequestAlgorithm()) {
+            case RSA_SHA1:
+                sigAlgo = WSConstants.RSA_SHA1;
+                jceSigAlgo = "SHA1withRSA";
+                break;
+            case RSA_SHA256:
+                sigAlgo = WSConstants.RSA_SHA256;
+                jceSigAlgo = "SHA256withRSA";
+                break;
+            default:
+                throw new ProcessingException("Unknown sign algorithm");
+            }
         }
         LOG.debug("Using Signature algorithm " + sigAlgo);
 
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
index 3f493b0..b7f5b22 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
@@ -99,75 +99,80 @@
             // PasswordCallbackHandler(password));
 
             SamlAssertionWrapper assertion = new SamlAssertionWrapper(token);
-            if (!assertion.isSigned()) {
-                LOG.warn("Assertion is not signed");
-                throw new ProcessingException(TYPE.TOKEN_NO_SIGNATURE);
-            }
-            // Verify the signature
-            Signature sig = assertion.getSignature();
-            KeyInfo keyInfo = sig.getKeyInfo();
-            SAMLKeyInfo samlKeyInfo =
-                org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromKeyInfo(
-                    keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData),
-                    requestData.getSigVerCrypto()
-                );
-            assertion.verifySignature(samlKeyInfo);
-
-            // Parse the subject if it exists
-            assertion.parseSubject(
-                new WSSSAMLKeyInfoProcessor(requestData), requestData.getSigVerCrypto(),
-                requestData.getCallbackHandler()
-            );
-
-            // Now verify trust on the signature
-            Credential trustCredential = new Credential();
-            trustCredential.setPublicKey(samlKeyInfo.getPublicKey());
-            trustCredential.setCertificates(samlKeyInfo.getCerts());
-            trustCredential.setSamlAssertion(assertion);
-
-            SamlAssertionValidator trustValidator = new SamlAssertionValidator();
-            trustValidator.setFutureTTL(config.getMaximumClockSkew().intValue());
-
-            boolean trusted = false;
+            
+            boolean doNotEnforceAssertionsSigned = !request.isEnforceTokenSigned();
+            
+            boolean trusted = doNotEnforceAssertionsSigned;
             String assertionIssuer = assertion.getIssuerString();
-
-            List<TrustedIssuer> trustedIssuers = config.getTrustedIssuers();
-            for (TrustedIssuer ti : trustedIssuers) {
-                Pattern subjectConstraint = ti.getCompiledSubject();
-                List<Pattern> subjectConstraints = new ArrayList<>(1);
-                if (subjectConstraint != null) {
-                    subjectConstraints.add(subjectConstraint);
+            
+            if (!doNotEnforceAssertionsSigned) {
+                if (!assertion.isSigned()) {
+                    LOG.warn("Assertion is not signed");
+                    throw new ProcessingException(TYPE.TOKEN_NO_SIGNATURE);
                 }
+                // Verify the signature
+                Signature sig = assertion.getSignature();
+                KeyInfo keyInfo = sig.getKeyInfo();
+                SAMLKeyInfo samlKeyInfo =
+                    org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromKeyInfo(
+                        keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData),
+                        requestData.getSigVerCrypto()
+                    );
+                assertion.verifySignature(samlKeyInfo);
 
-                if (ti.getCertificateValidationMethod().equals(CertificateValidationMethod.CHAIN_TRUST)) {
-                    trustValidator.setSubjectConstraints(subjectConstraints);
-                    trustValidator.setSignatureTrustType(TrustType.CHAIN_TRUST_CONSTRAINTS);
-                } else if (ti.getCertificateValidationMethod().equals(CertificateValidationMethod.PEER_TRUST)) {
-                    trustValidator.setSignatureTrustType(TrustType.PEER_TRUST);
-                } else {
-                    throw new IllegalStateException("Unsupported certificate validation method: "
-                                                    + ti.getCertificateValidationMethod());
-                }
-                try {
-                    for (TrustManager tm: config.getCertificateStores()) {
-                        try {
-                            requestData.setSigVerCrypto(tm.getCrypto());
-                            trustValidator.validate(trustCredential, requestData);
-                            trusted = true;
-                            break;
-                        } catch (Exception ex) {
-                            LOG.debug("Issuer '{}' not validated in keystore '{}'",
-                                      ti.getName(), tm.getName());
+                // Parse the subject if it exists
+                assertion.parseSubject(
+                    new WSSSAMLKeyInfoProcessor(requestData), requestData.getSigVerCrypto(),
+                    requestData.getCallbackHandler()
+                );
+
+                // Now verify trust on the signature
+                Credential trustCredential = new Credential();
+                trustCredential.setPublicKey(samlKeyInfo.getPublicKey());
+                trustCredential.setCertificates(samlKeyInfo.getCerts());
+                trustCredential.setSamlAssertion(assertion);
+
+                SamlAssertionValidator trustValidator = new SamlAssertionValidator();
+                trustValidator.setFutureTTL(config.getMaximumClockSkew().intValue());
+           
+                List<TrustedIssuer> trustedIssuers = config.getTrustedIssuers();
+                for (TrustedIssuer ti : trustedIssuers) {
+                    Pattern subjectConstraint = ti.getCompiledSubject();
+                    List<Pattern> subjectConstraints = new ArrayList<>(1);
+                    if (subjectConstraint != null) {
+                        subjectConstraints.add(subjectConstraint);
+                    }
+                
+                    if (ti.getCertificateValidationMethod().equals(CertificateValidationMethod.CHAIN_TRUST)) {
+                        trustValidator.setSubjectConstraints(subjectConstraints);
+                        trustValidator.setSignatureTrustType(TrustType.CHAIN_TRUST_CONSTRAINTS);
+                    } else if (ti.getCertificateValidationMethod().equals(CertificateValidationMethod.PEER_TRUST)) {
+                        trustValidator.setSignatureTrustType(TrustType.PEER_TRUST);
+                    } else {
+                        throw new IllegalStateException("Unsupported certificate validation method: "
+                                                        + ti.getCertificateValidationMethod());
+                    }
+                    try {
+                        for (TrustManager tm: config.getCertificateStores()) {
+                            try {
+                                requestData.setSigVerCrypto(tm.getCrypto());
+                                trustValidator.validate(trustCredential, requestData);
+                                trusted = true;
+                                break;
+                            } catch (Exception ex) {
+                                LOG.debug("Issuer '{}' not validated in keystore '{}'",
+                                          ti.getName(), tm.getName());
+                            }
                         }
-                    }
-                    if (trusted) {
-                        break;
-                    }
-
-                } catch (Exception ex) {
-                    if (LOG.isInfoEnabled()) {
-                        LOG.info("Issuer '" + assertionIssuer + "' doesn't match trusted issuer '" + ti.getName()
-                                 + "': " + ex.getMessage());
+                        if (trusted) {
+                            break;
+                        }
+                
+                    } catch (Exception ex) {
+                        if (LOG.isInfoEnabled()) {
+                            LOG.info("Issuer '" + assertionIssuer + "' doesn't match trusted issuer '" + ti.getName()
+                                     + "': " + ex.getMessage());
+                        }
                     }
                 }
             }
diff --git a/plugins/core/src/main/resources/schemas/FedizConfig.xsd b/plugins/core/src/main/resources/schemas/FedizConfig.xsd
index 15f82cf..4441594 100644
--- a/plugins/core/src/main/resources/schemas/FedizConfig.xsd
+++ b/plugins/core/src/main/resources/schemas/FedizConfig.xsd
@@ -172,6 +172,7 @@
                     <xs:element ref="disableDeflateEncoding" />
                     <xs:element ref="disableClientAddressCheck" />
                     <xs:element ref="doNotEnforceKnownIssuer" />
+                    <xs:element ref="doNotEnforceEncryptedAssertionsSigned" />
                     <xs:element ref="issuerLogoutURL" />
                 </xs:sequence>
                 <xs:attribute name="version" use="required" type="xs:string" />
@@ -185,10 +186,11 @@
     <xs:element name="applicationServiceURL" type="xs:string" />
     <xs:element name="metadataURI" type="xs:string" />
 
-    <xs:element name="signRequest" type="xs:boolean" />
+    <xs:element name="signRequest" type="SignRequestType" />
     <xs:element name="authnRequestBuilder" type="xs:string" />
     <xs:element name="disableDeflateEncoding" type="xs:boolean" />
     <xs:element name="doNotEnforceKnownIssuer" type="xs:boolean" />
+    <xs:element name="doNotEnforceEncryptedAssertionsSigned" type="xs:boolean" />
     <xs:element name="issuerLogoutURL" type="xs:string" />
     <xs:element name="disableClientAddressCheck" type="xs:boolean"/>
 
@@ -205,6 +207,21 @@
             <xs:element ref="reply" />
         </xs:sequence>
     </xs:complexType>
+    
+     <xs:complexType name="SignRequestType">
+        <xs:simpleContent>
+            <xs:extension base="xs:boolean">
+                <xs:attribute name="algorithm" type="signatureDigestAlgorithmType" />
+            </xs:extension>
+        </xs:simpleContent>
+    </xs:complexType>
+    
+    <xs:simpleType name="signatureDigestAlgorithmType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="RSA_SHA1" />
+            <xs:enumeration value="RSA_SHA256" />
+        </xs:restriction>
+    </xs:simpleType>
 
     <xs:complexType name="CallbackType">
         <xs:simpleContent>
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLEncryptedResponseTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLEncryptedResponseTest.java
index b801796..882df46 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLEncryptedResponseTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLEncryptedResponseTest.java
@@ -52,6 +52,7 @@
 import org.apache.cxf.fediz.core.SAML2CallbackHandler;
 import org.apache.cxf.fediz.core.config.FedizConfigurator;
 import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.exception.ProcessingException;
 import org.apache.cxf.fediz.core.processor.FedizProcessor;
 import org.apache.cxf.fediz.core.processor.FedizRequest;
 import org.apache.cxf.fediz.core.processor.FedizResponse;
@@ -86,6 +87,7 @@
 
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 /**
  * Some tests for processing SAMLResponses containing EncryptedAssertions using the SAMLProcessorImpl
@@ -150,7 +152,6 @@
     @org.junit.Test
     public void validateSignedEncryptedSAMLResponse() throws Exception {
         // Mock up a Request
-        //FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
         FedizContext config =
                 getFederationConfigurator().getFedizContext("ROOT_DECRYPTION");
 
@@ -199,12 +200,10 @@
     }
 
     @org.junit.Test
-    @org.junit.Ignore // TODO re-enable once we support unsigned encrypted assertions
     public void validateUnsignedEncryptedSAMLResponse() throws Exception {
         // Mock up a Request
-        //FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
         FedizContext config =
-                getFederationConfigurator().getFedizContext("ROOT_DECRYPTION");
+                getFederationConfigurator().getFedizContext("ROOT_DECRYPTION_ALLOW_UNSIGNED");
 
         String requestId = URLEncoder.encode(UUID.randomUUID().toString(), "UTF-8");
 
@@ -250,6 +249,53 @@
         assertClaims(wfRes.getClaims(), ClaimTypes.COUNTRY);
     }
 
+    @org.junit.Test
+    public void rejectUnsignedEncryptedAssertionByDefault() throws Exception {
+        // Mock up a Request
+        FedizContext config =
+                getFederationConfigurator().getFedizContext("ROOT_DECRYPTION");
+
+        String requestId = URLEncoder.encode(UUID.randomUUID().toString(), "UTF-8");
+
+        String relayState = URLEncoder.encode(UUID.randomUUID().toString(), "UTF-8");
+        RequestState requestState = new RequestState(TEST_REQUEST_URL,
+                TEST_IDP_ISSUER,
+                requestId,
+                TEST_REQUEST_URL,
+                (String)config.getProtocol().getIssuer(),
+                null,
+                relayState,
+                System.currentTimeMillis());
+
+        // Create SAML Response
+        SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler();
+        callbackHandler.setAlsoAddAuthnStatement(true);
+        callbackHandler.setStatement(SAML2CallbackHandler.Statement.ATTR);
+        callbackHandler.setConfirmationMethod(SAML2Constants.CONF_BEARER);
+        callbackHandler.setIssuer(TEST_IDP_ISSUER);
+        callbackHandler.setSubjectName(TEST_USER);
+        String responseStr = createSamlResponseStr(callbackHandler, requestId, false);
+
+        HttpServletRequest req = EasyMock.createMock(HttpServletRequest.class);
+        EasyMock.expect(req.getRequestURL()).andReturn(new StringBuffer(TEST_REQUEST_URL));
+        EasyMock.expect(req.getRemoteAddr()).andReturn(TEST_CLIENT_ADDRESS);
+        EasyMock.replay(req);
+
+        FedizRequest wfReq = new FedizRequest();
+        wfReq.setResponseToken(responseStr);
+        wfReq.setState(relayState);
+        wfReq.setRequest(req);
+        wfReq.setRequestState(requestState);
+
+        FedizProcessor wfProc = new SAMLProcessorImpl();
+        try {
+            wfProc.processRequest(wfReq, config);
+            fail("Failure expected on an unsigned token");
+        } catch (ProcessingException ex) {
+            // expected
+        }
+    }
+
     private String createSamlResponseStr(AbstractSAMLCallbackHandler saml2CallbackHandler,
                                          String requestId,
                                          boolean signAssertion) throws Exception {
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLRequestTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLRequestTest.java
index 34a3ddb..8910070 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLRequestTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/samlsso/SAMLRequestTest.java
@@ -42,6 +42,7 @@
 import org.apache.cxf.fediz.core.processor.SAMLProcessorImpl;
 import org.apache.cxf.fediz.core.util.DOMUtils;
 import org.apache.wss4j.common.saml.OpenSAMLUtil;
+import org.apache.wss4j.dom.WSConstants;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.core.LogoutRequest;
 
@@ -201,6 +202,34 @@
         String signature =
             redirectionURL.substring(redirectionURL.indexOf("Signature=") + "Signature=".length());
         Assert.assertTrue(signature != null && signature.length() > 0);
+        String signatureAlg =
+                redirectionURL.substring(redirectionURL.indexOf("SigAlg=") + "SigAlg=".length(),
+                        redirectionURL.indexOf('&', redirectionURL.indexOf("SigAlg=")));
+        Assert.assertEquals(WSConstants.RSA_SHA1, URLDecoder.decode(signatureAlg, "UTF-8"));
+    }
+
+    @org.junit.Test
+    public void testSignedSAMLAuthnRequestSHA256() throws Exception {
+        // Mock up a Request
+        FedizContext config = getFederationConfigurator().getFedizContext("SIGNED_ROOT_SHA256");
+
+        HttpServletRequest req = EasyMock.createMock(HttpServletRequest.class);
+        EasyMock.expect(req.getRequestURL()).andReturn(new StringBuffer(TEST_REQUEST_URL)).times(1, 2);
+        EasyMock.expect(req.getContextPath()).andReturn(TEST_REQUEST_URI);
+        EasyMock.expect(req.getRequestURI()).andReturn(TEST_REQUEST_URI).times(1, 2);
+        EasyMock.replay(req);
+
+        FedizProcessor wfProc = new SAMLProcessorImpl();
+        RedirectionResponse response = wfProc.createSignInRequest(req, config);
+
+        String redirectionURL = response.getRedirectionURL();
+        String signature =
+                redirectionURL.substring(redirectionURL.indexOf("Signature=") + "Signature=".length());
+        Assert.assertTrue(signature != null && signature.length() > 0);
+        String signatureAlg =
+                redirectionURL.substring(redirectionURL.indexOf("SigAlg=") + "SigAlg=".length(),
+                        redirectionURL.indexOf('&', redirectionURL.indexOf("SigAlg=")));
+        Assert.assertEquals(WSConstants.RSA_SHA256, URLDecoder.decode(signatureAlg, "UTF-8"));
     }
 
     @org.junit.Test
diff --git a/plugins/core/src/test/resources/fediz_test_config_saml.xml b/plugins/core/src/test/resources/fediz_test_config_saml.xml
index ff84520..37166c5 100644
--- a/plugins/core/src/test/resources/fediz_test_config_saml.xml
+++ b/plugins/core/src/test/resources/fediz_test_config_saml.xml
@@ -213,8 +213,38 @@
 				<claimType type="a particular claim type" optional="true" />
 			</claimTypesRequested>
 		</protocol>
-	</contextConfig>	
-	
+	</contextConfig>
+
+	<contextConfig name="SIGNED_ROOT_SHA256">
+		<audienceUris>
+			<audienceItem>http://host_one:port/url</audienceItem>
+		</audienceUris>
+		<certificateStores>
+			<trustManager>
+				<keyStore file="ststrust.jks" password="storepass"
+						  type="JKS" />
+			</trustManager>
+		</certificateStores>
+		<signingKey keyPassword="stskpass" keyAlias="mystskey">
+			<keyStore file="stsstore.jks" password="stsspass" type="JKS" />
+		</signingKey>
+		<trustedIssuers>
+			<issuer certificateValidation="PeerTrust" />
+		</trustedIssuers>
+
+		<maximumClockSkew>1000</maximumClockSkew>
+		<protocol xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+				  xsi:type="samlProtocolType" version="1.2">
+			<signRequest algorithm="RSA_SHA256">true</signRequest>
+			<issuer>http://url_to_the_issuer</issuer>
+			<roleDelimiter>;</roleDelimiter>
+			<roleURI>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role</roleURI>
+			<claimTypesRequested>
+				<claimType type="a particular claim type" optional="true" />
+			</claimTypesRequested>
+		</protocol>
+	</contextConfig>
+
 	<contextConfig name="CLIENT_TRUST">
 		<audienceUris>
 			<audienceItem>http://host_one:port/url</audienceItem>
@@ -364,4 +394,37 @@
 		<logoutURL>secure/logout</logoutURL>
 		<logoutRedirectTo>/redir.html</logoutRedirectTo>
 	</contextConfig>
+
+	<contextConfig name="ROOT_DECRYPTION_ALLOW_UNSIGNED">
+		<audienceUris>
+			<audienceItem>http://host_one:port/url</audienceItem>
+		</audienceUris>
+		<certificateStores>
+			<trustManager>
+				<keyStore file="ststrust.jks" password="storepass"
+						  type="JKS" />
+			</trustManager>
+		</certificateStores>
+		<trustedIssuers>
+			<issuer certificateValidation="PeerTrust" />
+		</trustedIssuers>
+		<tokenDecryptionKey keyPassword="stskpass" keyAlias="mystskey">
+			<keyStore file="stsstore.jks" password="stsspass" type="JKS" />
+		</tokenDecryptionKey>
+
+		<maximumClockSkew>1000</maximumClockSkew>
+		<protocol xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+				  xsi:type="samlProtocolType" version="1.2">
+			<issuer>http://url_to_the_issuer</issuer>
+			<roleDelimiter>;</roleDelimiter>
+			<roleURI>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role</roleURI>
+			<claimTypesRequested>
+				<claimType type="a particular claim type" optional="true" />
+			</claimTypesRequested>
+			<doNotEnforceEncryptedAssertionsSigned>true</doNotEnforceEncryptedAssertionsSigned>
+		</protocol>
+
+		<logoutURL>secure/logout</logoutURL>
+		<logoutRedirectTo>/redir.html</logoutRedirectTo>
+	</contextConfig>
 </FedizConfig>