Unencrypted NameID

[Cantor, Scott]

>     I'm new to shib so my understanding is evolving by the hour, so if I make
> no sense with my questions please bear with me.

You're making a very common error, so don't be offended when the response is that you're completely misunderstanding what you're seeing.

>     I'm having a problem authenticating to an SP who's service we've
> contracted.  When I had idp.encryption.optional set to false, we got the error
> SAML failed to login, Status code is
> urn:oasis:names:tc:SAML:2.0:status:Responder. When it is supposed to be
> urn:oasis:names:tc:SAML:2.0:status:Success

If the SP doesn't have a key, you can't do XML encryption. You can either use that optional flag or explicitly disable encryption for that relying party with an override in relying-party.xml

This has nothing to do with NameIDs in any way.

>     When I set idp.encryption.optional to true I can authenticate against my
> Shib server but then it looks like NameID is coming through encrypted.

No. That's a transientID, it's opaque. There are two ways to generate them. Both are opaque. Neither are encrypted in the sense you're thinking about. They are only used to provide a handle to an SP for making logout requests.

If an SP requires a NameID in a different form, then you can't use transient. That still has nothing to do with encryption, or with the property you're looking at.

> Based on some reading I've done it appears that NameID is encrypted if end
> to end encryption can't be assured,

It is not. The assertion would be encrypted, not the NameID alone, and it can't be because there's no key in the metadata, or it would be working.

-- Scott