Encrypting the IdPs assertion to an SP

[IAM David Bantz]

Attempting integration between my IdP and a Salesforce application (SP).
First attempt failed with the message:

11:40:34.793 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
- Could not resolve a key encryption credential for peer entity:
https://....force.com
11:40:34.793 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
- Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key
encryption credential.

I can disable encryption to this SP in relying-party.xml for now but it
highlighted my lack of understanding: There is a certificate in this SP's
metadata; why wasn't it used to encrypt the assertion.  Decoded certificate
indicates key usage for "Digital Signature, Key Encipherment"

The service provider subsequently sent the following message:
"When Salesforce is the service provider for inbound SAML assertions, you
can pick a saved certificate to decrypt inbound assertions from third party
identity providers. You need to provide a copy of this certificate to the
identity provider.

I've haven't previously received a separate key for encrypting assertions.
What do I do with it??

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151029/4b2b2958/attachment.html>