Encrypted Assertions and IDP Unsolicited SSO

[Castellow, Robert]

Hello:
I am attempting to disable encryption on assertions specifically for a vendor who requires IDP unsolicited SSO and unencrypted assertions:

The following steps were completed after adding our vendor SP into the metdata:

1.)    Added an entry to relying-party.xml (the DefaultRelyingParty for the SAML2SSOProfile has encryptAssertions="conditional") :

        <rp:RelyingParty id="https://kod.musc.edu"

                provider="https://shibboleth.musc.edu/shibboleth-idp"

                defaultSigningCredentialRef="musc_creds">

               <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" />

        </rp:RelyingParty>

2.)    The following URL is tested:  https://shibboleth-v.musc.edu/shibboleth-idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fkod.musc.edu

and the following error is received:
17:18:58.178 - INFO [Shibboleth-Access:74] - 20120330T211858Z|128.23.43.89|shibboleth-v.musc.edu:443|/profile/SAML2/Unsolicited/SSO|
17:18:58.179 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder:157] - No providerId parameter given in unsolicited SSO authentication request.
17:18:58.180 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:373] - Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: No providerId parameter given in unsolicited SSO authentication request.


This all works if the relying party entry from #1 is never added and the defaultRelyingParty for the SAML2SSOProfile type is set to encryptAssertions="never" , but I'm failing to make this configuration vendor specific.  What would cause my providerId to be dropped when I add this entry to the relying-party.xml?

Thanks in advance.

Rob Castellow
Systems Engineer
IAS, OCIO
Medical University of South Carolina

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120330/da64e272/attachment.html