Disabling Encrypted Assertions and Encrypted NameIDs in IDPv3?

[McKean, Brandon Scott - mckeanbs]

Thanks much Scott! That did it and got it past that point.

For general reference, to others following, what had to be done:

<bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" p:encryptAssertions="false" p:encryptNameIDs="false"/>


-- 
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235
________________________________________
From: users [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Friday, June 12, 2015 10:27 AM
To: Shib Users
Subject: Re: Disabling Encrypted Assertions and Encrypted NameIDs in IDPv3?

On 6/12/15, 10:00 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

>
>Specifically, I believe I'm having trouble with their Step 6, disabling encrypted assertions and encrypted nameids.

NameID encryption is not a default feature. Turning off assertion encryption is controlled with the encryptAssertions property, which is a boolean.

https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration

><bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
><bean parent="SAML2.SSO" p:encryptAssertions="Never"/>
><bean parent="SAML2.SSO" p:encryptNameIDs="Never"/>

You can't do that. Well, I don't honestly know what it will do, but you don't create multiple beans of the same profile type, just set whatever properties you want to set in the one bean. And "Never" is not a boolean value, that's a setting from the V2 legacy configuration format.

>Does this look to be correct? If not can someone point me in the right direction? I've tried looking at the wiki for relying-party but I find it a bit lacking in very clear examples for this.

It should be linking to the SecurityConfiguration page, but I'll look at it.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net