Anonymous RP / ECP / SSO profiles / encryption

[Cantor, Scott]

> I was looking into Shibboleth SAML profiles. It seems that Shibboleth
> supports anonymous SPs which is called AnonymousRelyingParty.

Not any more. Unverified now, which is more accurate.

> Could this be used to bypass out-of-band registration?

Yes, provided you simply eliminate most of the policy from your IdP.

> Are anonymous RPs Shibboleth
> specific, or does SAML 2.0 generally does not enforce SP registration?

It's outside the spec, I have no idea what others support. It's effectively just a degenerate case.

> Furthermore, I would like to force encryption of assertions or attributes. Is
> there a way in SAML 2.0 to include the certificate/public key of the SP in the
> AuthnRequest which could be used for encryption?

No, nor would it make any sense, an attacker would simply supply their key. You can't have security while turning off security.
 
-- Scott