Assertion encryption

[Steven Teixeira]

Start here:

https://wiki.shibboleth.net/confluence/display/CONCEPT/Home

Authentication requests come from the SP. Authentication Responses, which contain the assertions, are sent by the IdP.  Shibboleth encrypts assertions by default I believe, but maybe I’ll be corrected.

Yes, you can disable encryption with hints here:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

but Shibboleth logging can be turned up to DEBUG to see assertions before encryption without having to disable it.  You should also understand the risks of not encrypting the assertions.

Steven Teixeira

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Larissa Riedel
Sent: Wednesday, July 5, 2017 12:21 PM
To: Shib Users <users at shibboleth.net>
Subject: Assertion encryption

Hi folks,

I try to figure out how the concept of the assertions works.
Is there an assertion from the SP to the IDP, or is it just a "request"? If so, is the assertion encrypted?
Is there a possibility to disable the encryption (only for testing), so that I can see the assertions in the browser (SAML tracer)?

I would be happy for any explanation.
Kind regards,
Larissa
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170705/1d62ce97/attachment.html>