unencrypted assertions not working

[David Langenberg]

+1 to requiring SPs to at least support it in the federation.  

Dave

--
David Langenberg
Identity & Access Management
The University of Chicago




On Apr 3, 2013, at 9:00 AM, "Curry, Warren" <whcurry at ufl.edu>
 wrote:

> I concur with max and we always require
> 
> Warren H. Curry
> UFIT - Identity Access Management
> PO Box 113359,  2008 NE Waldo Rd
> 352-273-1383 
> 
> Have a great day!!!
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mark K. Miller
> Sent: Wednesday, April 03, 2013 10:21 AM
> To: Shib Users
> Subject: Re: unencrypted assertions not working
> 
> 
> On Wed, 3 Apr 2013, lalithj wrote:
> 
>> Hi,
>> 
>> We got a new SP requirment that they need unencrypted assertions, am 
>> not sure whether this is the best practice or not(which is a seperate 
>> question)
> 
> During new engagements I've had many SPs come back to me with this 'requirement.'  I tell them, in my opinion, it is not a best practice, and refuse to do it.  I have them configure their SP to handle encrypted assertions.
> 
> I have no clue what federation/trust model the OP participates in, but, if I may jump on my 'InCommon soapbox' for a moment.  It's my opinion that its always best to guide new services in a direction that will require the least effort for them and their future business partners.  In this case, specifically, I think most of the IdPs in InCommon send encrypted assertions by default.  So, in the initial engagement, if we can get a new SP accepting encrypted assertions it's far less total effort for everyone in the long run.
> 
> Everyone's mileage varies,
> 
> Max
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net