SP - How to require an encrypted assertion?

[Marc Boorshtein]

Peter,

Neither.  I'm using Shibboleth (both idp and sp) as a reference
implementation of SAML2 to test my own product in automated tests.

Scott,

I get what you're saying, it's the idp's data so its their responsibility
to enforce encryption.  I know that its common amongst over saml products
to have a flag to require encryption.  I've also found it useful if there's
a change in configuration on the idp side and something is missed and
assertions are no longer encrypted users will experience login failures
which will alert the sys admins to the issue.  It doesn't stop the leak of
information but might stop the bleeding.

I'm going to open a feature request on the idp, would it be the same place
for the sp?

Thanks
Marc

On Mon, Mar 16, 2015 at 9:31 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/15/15, 11:32 PM, "Marc Boorshtein" <mboorshtein at gmail.com> wrote:
>
> >On apache 2.2 on CentOS 6.x.  I have encrypted assertions working, but I
> can't figure out how to enforce that only encrypted assertions are allowed.
>
> It isn't really treated as the SP's "concern" since the data doesn't
> belong to it, and I don't believe I ever included any setting like that.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150316/e859f01d/attachment.html