Please direct any further dev questions to the dev list. > Can anyone point me to the source code where the shibboleth SP is > decrypting the SAML 2.0 response message? SAML doesn't allow encryption of responses, only assertions and some other assertion content. -- Scott