unencrypted assertions not working

[Curry, Warren]

I concur with max and we always require

Warren H. Curry
UFIT - Identity Access Management
PO Box 113359,  2008 NE Waldo Rd
352-273-1383 

Have a great day!!!


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mark K. Miller
Sent: Wednesday, April 03, 2013 10:21 AM
To: Shib Users
Subject: Re: unencrypted assertions not working


On Wed, 3 Apr 2013, lalithj wrote:

> Hi,
>
> We got a new SP requirment that they need unencrypted assertions, am 
> not sure whether this is the best practice or not(which is a seperate 
> question)

During new engagements I've had many SPs come back to me with this 'requirement.'  I tell them, in my opinion, it is not a best practice, and refuse to do it.  I have them configure their SP to handle encrypted assertions.

I have no clue what federation/trust model the OP participates in, but, if I may jump on my 'InCommon soapbox' for a moment.  It's my opinion that its always best to guide new services in a direction that will require the least effort for them and their future business partners.  In this case, specifically, I think most of the IdPs in InCommon send encrypted assertions by default.  So, in the initial engagement, if we can get a new SP accepting encrypted assertions it's far less total effort for everyone in the long run.

Everyone's mileage varies,

Max
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net