Encrypting the IdPs assertion to an SP

[IAM David Bantz]

Thanks for clarifying Brent. I had guessed at adding the new encryption
cert to my copy of the SP metadata with use="encryption" but then I looked
in the InCommon metadata for such use and found no such examples. I infer
the de facto default is using the same key for both signing and encryption
and omitting the use clause, with only those SPs that do not want encrypted
assertions adding the use="signing".

On Thu, Oct 29, 2015 at 4:49 PM, Brent Putman <putmanb at georgetown.edu>
wrote:

>
> ...The cert in the SP's metadata isn't resolvable for encryption, mostly
> likely because its KeyDescriptor has use="signing".  You'd want to either
> remove the 'use' attribute, or add a new KeyDescriptor with the same or
> another cert, and marked with use="encryption"...
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151029/81a0a806/attachment.html>