unencrypted assertions not working

[Cantor, Scott]

On 4/4/13 9:37 PM, "lalithj" <j_lalith at hotmail.com> wrote:
>
>Yes I do agree, we need to follow the best practice (encryption).

If you want the data protected end to end, you encrypt, if not, not.
Whether that's a best practice depends on who's answering.

It's very common for people to evaluate data exchanges and conclude that
it doesn't matter. Then the application might change and some piece of
additional data is added that would not be unprotected. But by then it's
too late and nothing usually changes to address the different requirement.

The reason we encrypt is simple. It's easy and it's done. The
implementations that can't handle encryption are not SAML compliant. That
usually means they will be lousy in other respects because implementers
that cut corners always have a reason for cutting the next corner. One can
always find a good reason not to do something.


But you're going to run into many vendors that can't do this. There's
probably not much you're going to be able to do about it. You just have to
understand what you're doing and make sure an appropriate person approves
the decision.

>But for my knowledge, considering the handshake in happenning  on SSL
>(https
>end points), what sort of security issue will this cause?

The data is accessible to the client and to any malware installed on the
client. It's visible to the user, which is not always desirable in some
environments.

-- Scott