Disabling Encrypted Assertions and Encrypted NameIDs in IDPv3?

[Cantor, Scott]

On 6/12/15, 10:00 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

>
>Specifically, I believe I'm having trouble with their Step 6, disabling encrypted assertions and encrypted nameids.

NameID encryption is not a default feature. Turning off assertion encryption is controlled with the encryptAssertions property, which is a boolean.

https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration

><bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
><bean parent="SAML2.SSO" p:encryptAssertions="Never"/>
><bean parent="SAML2.SSO" p:encryptNameIDs="Never"/>

You can't do that. Well, I don't honestly know what it will do, but you don't create multiple beans of the same profile type, just set whatever properties you want to set in the one bean. And "Never" is not a boolean value, that's a setting from the V2 legacy configuration format.

>Does this look to be correct? If not can someone point me in the right direction? I've tried looking at the wiki for relying-party but I find it a bit lacking in very clear examples for this.

It should be linking to the SecurityConfiguration page, but I'll look at it.

-- Scott