Can encryptAssertions be configured for a specific SP

[Lohr, Donald]

On 03/24/2015 03:58 PM, Cantor, Scott wrote:
> On 3/24/15, 10:29 AM, "Lohr, Donald" <lohrda at jmu.edu> wrote:
>> I've done some looking and searching, but can not readily find the
>> previous thread mentioned below.  I would be interested in how to
>> accomplish this.
> Assuming you mean V2, https://wiki.shibboleth.net/confluence/display/SHIB2/IdPXMLSigEnc
>
> -- Scott
>

Yes, V2 Shibboleth.  After reviewing the url you provided and also doing 
some additional research, I came up with the following example:


     <!-- Relying Party setting for Acme.com -->
         <RelyingParty id="https://mysite.acme.com"
             provider="https://shibboleth.acme.com/idp/shibboleth"
             defaultSigningCredentialRef="IdPCredential">
         <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" 
encryptAssertions="never"
             encryptNameIds="never" />
     </RelyingParty>

...does this look like a workable way to set a specific SP to have 
encryptAssertions="never" and keep the DefaultRelyingParty at 
encryptAssertions="conditional" ?

Thanks

-- 
D o n a l d   L o h r

i n f o r m a t i o n   s y s t e m s
j a m e s   m a d i s o n   u n i v e r s i t y

5 4 0 . 5 6 8 . 3 7 3 0