SP-specific failure to generate 'good' SAML assertion

[Cantor, Scott]

>
>Not the same SAML, no.

Your new output has the transient ID encrypted inside the EncryptedID
element. You normally don't want to encrypt just the NameID, and a lot of
SPs can't handle that either.

I don't know what the SP needs, but you should generally set the
encryptNameID option or whatever it's called to never, and conditionally
encrypt the assertion. (Or not encrypt at all for that SP if it doesn't
handle that.)

Anway, bottom line, you fixed the transient ID release problem.

-- Scott