using cert in SP metadata for encryption

[Peter Schober]

* IAM David Bantz <dabantz at alaska.edu> [2016-11-18 00:19]:
> FWIW, here's what the SP's metadata looks like:

Note that that metadata is not even well-formed XML (nor XSD
schema-valid) as it's missing a closing tag for the md:SPSSODescriptor
element. (May be an artifact of preparing your email, of course.)

As to the encryption issue: Since the metadata is signed (and includes
the key its signed with) you could try adding that same certificate as
a KeyDescriptor to the SP and see whether it will be able to decrypt
messages using that key. Might be worth a try, if you're managing a
local copy of their metadata anyway. (It might also be worth trying to
get that SP to use fully qualified attribute names.)

Btw, trying to access https://nextgensso.com/ in a web browser leads
to an error message with a footer suggesting it's using a Ping
Identity service or software. I'd be surprised to hear Ping doesn't
even support encrypted SAML Reponses or Assertions, so if in doubt (as
you seem to be) ask the vendor/SP.
-peter