Shibboleth encryption questions

[Cantor, Scott]

On 3/9/16, 1:06 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:



>I've successfully migrated most of my V2 configuration to V3 (3.2.1).  One aspect that eludes me is encryption of the SAML response.  It looks as if entities that use the DefaultRelyingParty configuration have the SAML response encrypted

As in V2.

> (entities that are in the overrides group do not have the response encrypted).

Well, that's up to you.

>Can this me changed so that response is not encrypted?

You can choose how you want to handle encryption completely. You already did, if you changed the settings for the overrides.

>Is this not recommended?

Sending data in the clear to a browser today basically exposes it to the world, given that browsers may as well be malware at this point. What you do about that is really a local decision.

>  Also, does this have anything to do with the Cookie Encryption Key?

No.

>Finally, with regards to the Cookie Encryption Key, does this key have anything to do with an IdP's SAML response to an SP?

Not in any direct sense.

-- Scott