Assertion encryption

[Klingenstein, Nate]

> Shibboleth encrypts assertions by default I believe, but maybe I’ll be corrected.

Just an addendum.  Default behavior is to encrypt if there is an encryption-valid certificate in the SP's metadata, and to error out with no encryption if there is no certificate present.

You can permit your IdP to send unencrypted assertions to SP's that have no keys by setting idp.encryption.optional=true in idp.properties.

Everything else Steven wrote is spot on.