sending Certificate within SAML response from Idp

[samir el otmani]

I have a question about Idp response ,what i understand is the Idp send the
SAML response with an encrypted assertion and one public key sent with the
same response (public key of SP ) .

what is someone else create one reponse with an  encrypted
assertion(manually)  and send it into an Idp .
second question , why is it important to send the public key within the
response.

can anyone help me to understand this chain ?




<?xml version="1.0" encoding="UTF-8"?><saml2p:Response
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="
http://sp.example.com/Shibboleth.sso/SAML2/POST"
ID="_a5fb1e00ce28b5d978fdbc96ff12d047"
InResponseTo="_3038953c889f6818dbe819d1780c0a70"
IssueInstant="2015-02-12T15:50:44.980Z" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
https://idp.example.com/idp/shibboleth</saml2:Issuer>
   <saml2p:Status>
      <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </saml2p:Status>
   <saml2:EncryptedAssertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="_b63280d236530ffc78f01fc91794c86f" Type="
http://www.w3.org/2001/04/xmlenc#Element">
         <xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#"/>
         <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <xenc:EncryptedKey Id="_4c5205782b18e2bd90270b1b0c620562"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
               <xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#">
                  <ds:DigestMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="
http://www.w3.org/2000/09/xmldsig#"/>
               </xenc:EncryptionMethod>
               <ds:KeyInfo>
                  <ds:X509Data>
                     <ds:X509Certificate> Certificate </ds:X509Certificate>
                  </ds:X509Data>
               </ds:KeyInfo>
               <xenc:CipherData xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#">

<xenc:CipherValue>XGGQEqxA1YIGAsthbRnKn8i5n2lMPmYYCBufKmoibbYlFApJh5+h8H01xQ+2wr3uBtBQQwVJzf7vNBFyClHX0hWfQMY0t4NRkGKzFpcY0Aki+lzZMVgm245xNmLRrwOLtb57cNJlh3E2FgjBwEXJHTBIffFa6P75FQq+qCPWfhM=</xenc:CipherValue>
               </xenc:CipherData>
            </xenc:EncryptedKey>
         </ds:KeyInfo>
         <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <xenc:CipherValue>
Encrypted assertion
</xenc:CipherValue>
         </xenc:CipherData>
      </xenc:EncryptedData>
   </saml2:EncryptedAssertion>
</saml2p:Response>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150212/2cd0ebff/attachment.html