Can encryptAssertions be configured for a specific SP

[Peter Schober]

* Jeffrey McKenzie <JMcKenzie at trustwave.com> [2015-01-08 19:28]:
> I can see how to turn off encrypting assertions for the Shibboleth
> IDP by setting the ProfileConfiguration encryptAssertions in the
> relying-party.xml to "never".  But that means it'll never
> encryptAssertions for anyone, right?  Can I configure the IDP to
> only encryptAssertions to specific Service Providers.

Yes, and yes.

> Or more precisely what I'd like to do it turn encryption of
> assertions off for a particular service provider that can't seem to
> handle pulling my login id out of an attribute in the assertion AND
> decrypting the assertion.  However for other service providers I'd
> like to be able to leave encryption of assertions set to
> "conditional".

You'll need to create a RelyingParty element specific for that SP
(after the DefaultRelyingParty element, in your relying-party.xml),
and turn off encryption there.
-peter