Disabling off Encryption for a Relying Party

[Hall, Gerry]

I have set up a version 3 IdP and am in the process of making the necessary changes to the V3 configurations to reflect what I currently have configured on the V2 IdP.  One thing that I need to do is turn off encryption for specific vendor SP's.  Below  is what I am using for the V2 configuration and the V3 configuration.  However, the V3 configuration does not seem to work as expected.  When I attempt to login to one of the SP's, I get a response similar to the following repeated over and over in the V3 IdP logs.

>From what I can tell, the IdP successfully authenticates but the SP does not recognize the attribute as returned by the IdP; in a browser I can clearly see the message 'user AAdzaBBxarzzawtssshe1zn3!! not found' repeated over and over; this leads me to believe that the user attribute is still encoded (note the I actually see a string like 'AAdzaBBxarzzawtssshe1zn3!!' in the browser) .  I believe that, as in version 2 , I need to somehow include the    provider="https://login.emory.edu/idp/shibboleth" and the defaultSigningCredentialRef="IdPCredential" (of course this is only a guess at this point).  Its probably somewhere in the DOC's but I cannot seem to locate it.

Can someone provide an example of the version 3 configuration and if possible point me to the appropriate DOC's for IdP version 3?

Thanks in advance for any assistance.

(from version 3 IdP logs)
2015-10-16 07:53:46,229 - DEBUG [org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:220] - Setting RelayState parameter to: 'https://emory.service-now.com/navpage.do', encoded as 'https://emory.service-now.com/navpage.do'
2015-10-16 07:53:46,245 - INFO [Shibboleth-Audit.SSO:241] - 20151016T115346Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|SNC3769762114e9f795325b5a5a34e9f4ae|https://emory.service-now.com/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.emory.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e96a91240794402e2a903d03322647b3|ghall4|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|serialNumber,transientId|AAdzZWNyZXQx6yPgQZRUvqwu42dCaUDU5sr4QpGfkwk+UcFLgt57639oJ+UcNvYcaY1ejQSzed539zwLdYwVdcHOmn+h09zzq9TlMUjWi1AH2++pKp+WcGlslA/4v1Ka2BmNDwW7rhlTrH0F|_c54b44c552ec920aa18384f8f770c5cd


(working version 2 configuration for disabling encryption)
    <RelyingParty id="https://emory.service-now.com/"
        provider="https://login.emory.edu/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
    </RelyingParty>

    <RelyingParty id="apperian.com.:ssoDevelopment"
        provider="https://login.emory.edu/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
    </RelyingParty>

(not working version 3 configuration for disabling encryption)
       <bean parent="RelyingPartyByName" c:relyingPartyIds="https://emory.service-now.com/" >
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

       <bean parent="RelyingPartyByName" c:relyingPartyIds="apperian.com">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151016/3455f0f4/attachment.html>