Encrypted Data

[Cantor, Scott]

On 12/10/13, 10:47 AM, "vyal2k" <vyal2k at yahoo.com> wrote:

>Hi,
> I have few questions regarding Encryption.
>1) Are Assertions, the NameIds and Attributes the only ones that could be
>encrypted by IdP?

Those are the only constructs SAML allows to be encrypted. In practice you
should never encrypt anything but an assertion unless you have a good
reason.

>2) What IdP metadata controls if something (Assertion, NameId or
>Attribute) needs to be encrypted?

There are no metadata fields related to encryption aside from the
cryptography itself, nothing about policy.

>3) Would IdP require LogoutRequest's NameId to be encrypted by SP using
>IdP's certificate? If Yes, how would IdP know if it is encrypted?

The IdP doesn't support decryption today, so it will simply fail. I don't
understand the rest of your question, you know if something's encrypted by
looking at it.

Also, as a technical matter, you don't encrypt anything with a
certificate, you use the public key.

-- Scott