Assertion encryption

[Peter Schober]

* Larissa Riedel <larissa.riedel88 at gmail.com> [2017-07-05 21:21]:
> I try to figure out how the concept of the assertions works.
> Is there an assertion from the SP to the IDP, or is it just a "request"? If
> so, is the assertion encrypted?

It is just a request from the SP, and that's not encrypted (though the
NameID could, IIRC, though that's not used in practice) and everything
in the request can easily seen in SAML Tracer.

The request might be signed by the SP, though. The majority don't sign
their requests (because the advantages of signing are debatable) but
it's not that uncommon either.

Regarding actual assertions (sent from the IDP to the SP) others have
answered that already, I think.
-peter