On Thu, Nov 17, 2016 at 6:18 PM, IAM David Bantz <dabantz at alaska.edu> wrote: > FWIW, here's what the SP's metadata looks like: That entity descriptor is signed but it contains no KeyDescriptor element. Therefore the SP can not sign outbound messages and the IdP is not able encrypt message data. Tom