Disabling off Encryption for a Relying Party

[Peter Schober]

* Hall, Gerry <gerry.hall at emory.edu> [2015-10-16 14:10]:
> From what I can tell, the IdP successfully authenticates but the SP
> does not recognize the attribute as returned by the IdP; in a
> browser I can clearly see the message 'user
> AAdzaBBxarzzawtssshe1zn3!! not found' repeated over and over; this
> leads me to believe that the user attribute is still encoded (note
> the I actually see a string like 'AAdzaBBxarzzawtssshe1zn3!!' in the
> browser)


Use Mozilla Firefox with the SAMLtracer plugin, then look at the lines
which include an organe SAML box on the right-hand side of the window.
Look for and click on the line with the SAML response then below an
index for SAML will apprear, which the properly decoded SAML response.

You'll clearly see what's inside there and what isn't.
E.g. if the assertion is encrypted you won't find an element called
Assertion (in some namespace), but an EncyrptedAssertion.

The string above could be an (unencrypted) attribute in an
(unenctypted) assertion, or it could be in an (unencrypted, by
default) NameID -- which is not part of the Assertion (and hence
wouldn't be encrypted with it).

So first find out what's happening. The relying party overrides look
fine to me (if they are in the right section) and unless you've put in
the work to turn the string you see into a NameID that probably means
it's working as expected and assertions are not in fact encrypted.
-peter