Profile Configuration and meaning of "conditional" setting

[Lukas Hämmerle]

Hello all

Since I have not found a wiki page about that I ask here. What exactly
is happening when in the relying-party.xml of an IdP a profile
configuration has set: encryptAssertions="conditional"

Based on what condition will an assertion be encrypted exactly? I'm
debugging an issue where an SP in metadata has now embedded
certificates. The IdP then complains " Could not resolve a key
encryption credential for peer entity". However, the assertion is sent
via https to the peer entity and according to
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPXMLSigEnc I
would assume that in this case the assertion encryption is not necessary.

According to the method isEncryptAssertion of
http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/AbstractSAML2ProfileHandler.java?view=markup

encryption is only applied in the conditional case if
encoder.providesMessageConfidentiality(requestContext) is false. So, the
question is based on what conditions this method returns true or false.
Is returning the assertion via https sufficient to make this method
return true?

Kind Regards
Lukas

-- 
SWITCH
Serving Swiss Universities
--------------------------
Lukas Hämmerle, Central Solutions
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch