Disable encryption on SAML response

[Christopher Bongaarts]

For Oracle Weblogic SAML integrations, we also needed to adjust how the 
SAML response is generated.  We use this in relying-party.xml:

         <!-- turn off encryption, sign assertions not responses, sign 
with SHA1, use alt nameid -->
         <bean parent="RelyingPartyByName" 
c:relyingPartyIds="https://sp.example.org/">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
                           p:signResponses="false" p:signAssertions="true"
p:securityConfiguration-ref="SHA1SecurityConfig"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" 
/>
                 </list>
             </property>
         </bean>

You might not need the nameIDFormatPrecedence setting if you're using 
the modern v3 methods for nameID generation.


On 1/24/2018 6:44 PM, Rafael Peroco wrote:
> Nate,
>
> Thank you for your answer.
>
> I've followed your instructions but keep getting "400 Bad request" 
> from SP.
>
> For confirmation, I set:
> idp.encryption.optional = true
>
> Is that right?
>
> Em qua, 24 de jan de 2018 às 21:53, Klingenstein, Nate 
> <nklingenstein at calstate.edu <mailto:nklingenstein at calstate.edu>> escreveu:
>
>     Rafael,
>
>     You need to set encryption to be optional using idp.properties. 
>     That won’t disable it, but it will allow the IdP to send
>     assertions that are not encrypted if there is also no key
>     available for encryption to that service provider.
>
>     Between that setting and ensuring there is no encryption key, you
>     should be set.
>
>     Take care,
>
>     Nate.
>
>     *From:*users [mailto:users-bounces at shibboleth.net
>     <mailto:users-bounces at shibboleth.net>] *On Behalf Of *Rafael Peroco
>     *Sent:* Wednesday, January 24, 2018 3:45 PM
>     *To:* users at shibboleth.net <mailto:users at shibboleth.net>
>     *Subject:* Disable encryption on SAML response
>
>     Is there a way to disable the SAML response encryption?
>
>     The SP side (Oracle) is saying that need response without
>     cryptography.
>
>     Thanks
>
>
>
>     -- 
>
>     *RAFAEL PEROCO*
>
>     +55 11 4210-0550 <tel:+551142100550>
>
>     +55 21 2018-1310 <tel:+552120181310>
>
>     +55 44 99142-2910 <tel:+5544991422910>
>
>     XLSOLUTIONS
>
>     www.xlsol.com <http://www.xlsol.com>
>
>     --
>     For Consortium Member technical support, see
>     https://wiki.shibboleth.net/confluence/x/coFAAg
>     To unsubscribe from this list send an email to
>     users-unsubscribe at shibboleth.net
>     <mailto:users-unsubscribe at shibboleth.net>
>
> -- 
> RAFAEL PEROCO
> +55 11 4210-0550 <tel:+551142100550>
> +55 21 2018-1310 <tel:+552120181310>
> +55 44 99142-2910 <tel:+5544991422910>
>
> XLSOLUTIONS
> www.xlsol.com <http://www.xlsol.com>
>
>

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180125/8e1743a3/attachment.html>