EncryptionMethod in Metadata

[Eric Goodman]

Greetings all,

This is not a Shibboleth question but a more general SAML/metadata one. I'm working with a (non-Shib) IdP integrated with a (non-Shib) SP and was getting errors encrypting assertions. The issue is a mismatch between the IdP metadata and the SP metadata.

In the IdP Metadata (the local metadata read by the IdP), the encryption key section contains:

<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc">
                <xenc:KeySize xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">128</xenc:KeySize>
</md:EncryptionMethod>

In the SP-provided metadata (again, also loaded on the IdP side), it contains:
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" />


When trying to send an assertion between these two, I get "Data encryption algorithm and strength mismatch" errors. I was able to fix the error two different ways: (a) adding the 128 KeySize child element to the SP's EncyptionMethod tag, or (b) removing the EncryptionMethod element altogether. Note that I did not change the SP's actual configuration in any way, just edited my IdP's local copy of the SP's metadata.

My questions for the collective:

1) Is this (declaring the encryption methods to be incompatible) correct or buggy behavior on the part of my IdP? (I can believe either answer)

2) Given that I don't see any entries in the InCommon Metadata that contain an EncryptionMethod element, I'd guess that best practice is to just omit these entries from metadata. Are there any reasons to include this information?

Thanks, and happy 4th for those that celebrate,

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130703/413b3052/attachment-0001.html