Are SPs without a certificate common?

[Christopher Bongaarts]

On 3/1/2013 10:45 AM, Tim Larson wrote:
> I am working with a commercial Service Provider that does not include a
> public key in the SP metadata and they are saying they don’t accept
> encrypted assertions.  They say all they want is the assertion to be
> signed with the IDP key and everything should pass in the clear.
>
> Is this common and should it be acceptable?
>

I've got about 8 listed in my production relying-party.xml file (out of 
a few hundred SPs).  So it's not particularly common, but neither is it 
rare.  The list includes a couple of Big Players (Google Apps, 
Salesforce, Service Now)...

Scott covered the acceptability angle; obviously we don't have a big 
deal with it.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%