Use of EncryptedID not supported in LogoutRequest

[Cantor, Scott]

On 7/13/16, 7:29 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:

> A quick search shows that in the v2 IdP the
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler throws a
> ProfileException with that exact error string "Use of EncryptedID not supported in
> LogoutRequest" if the LogoutRequest has an EncryptedID rather than a plaintext NameID.
>
> So it's likely that this is a v2 IdP.

I figured. So again, this is: a) caused by incorrect IdP metadata, and b) can be worked around by explicitly setting encryption to false to turn off the update's support for opportunistically encrypting if there's a key available.    
    
The SP won't break if it can't find a key unless encryption is explicitly turned on. The conditional/default setting simply encrypts if it can and skips it if it can't, as documented (and I meant to note this new behavior in the release notes, it's added).

I really have no idea how much metadata out there is broken, but InCommon's isn't; the keys in IdP metadata today are all marked use="signing".

-- Scott