Disable encryption on SAML response

[Rafael Peroco]

Christopher,

The system is Oracle RightNow,

Nate

Now Im getting from the SP side the information that IdP is not sending
NameID. Can some information is missing in the relaying party?

Thanks



Em qui, 25 de jan de 2018 às 21:16, Christopher Bongaarts <cab at umn.edu>
escreveu:

> For Oracle Weblogic SAML integrations, we also needed to adjust how the
> SAML response is generated.  We use this in relying-party.xml:
>
>         <!-- turn off encryption, sign assertions not responses, sign with
> SHA1, use alt nameid -->
>         <bean parent="RelyingPartyByName" c:relyingPartyIds=
> "https://sp.example.org/" <https://sp.example.org/>>
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
>                           p:signResponses="false" p:signAssertions="true"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
>
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> />
>                 </list>
>             </property>
>         </bean>
>
> You might not need the nameIDFormatPrecedence setting if you're using the
> modern v3 methods for nameID generation.
>
> On 1/24/2018 6:44 PM, Rafael Peroco wrote:
>
> Nate,
>
> Thank you for your answer.
>
> I've followed your instructions but keep getting "400 Bad request" from
> SP.
>
> For confirmation, I set:
> idp.encryption.optional = true
>
> Is that right?
>
> Em qua, 24 de jan de 2018 às 21:53, Klingenstein, Nate <
> nklingenstein at calstate.edu> escreveu:
>
>> Rafael,
>>
>>
>>
>> You need to set encryption to be optional using idp.properties.  That
>> won’t disable it, but it will allow the IdP to send assertions that are not
>> encrypted if there is also no key available for encryption to that service
>> provider.
>>
>>
>>
>> Between that setting and ensuring there is no encryption key, you should
>> be set.
>>
>>
>>
>> Take care,
>>
>> Nate.
>>
>>
>>
>> *From:* users [mailto:users-bounces at shibboleth.net] *On Behalf Of *Rafael
>> Peroco
>> *Sent:* Wednesday, January 24, 2018 3:45 PM
>> *To:* users at shibboleth.net
>> *Subject:* Disable encryption on SAML response
>>
>>
>>
>> Is there a way to disable the SAML response encryption?
>>
>>
>>
>> The SP side (Oracle) is saying that need response without cryptography.
>>
>>
>>
>> Thanks
>>
>>
>>
>> --
>>
>> *RAFAEL PEROCO*
>>
>> +55 11 4210-0550 <+551142100550>
>>
>> +55 21 2018-1310 <+552120181310>
>>
>> +55 44 99142-2910 <+5544991422910>
>>
>>
>>
>> XL SOLUTIONS
>>
>> www.xlsol.com
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
> --
> RAFAEL PEROCO
> +55 11 4210-0550 <+551142100550>
> +55 21 2018-1310 <+552120181310>
> +55 44 99142-2910 <+5544991422910>
>
> XL SOLUTIONS
> www.xlsol.com
>
>
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809 <(612)%20625-1809>    %%
>
> --
RAFAEL PEROCO
+55 11 4210-0550 <+551142100550>
+55 21 2018-1310 <+552120181310>
+55 44 99142-2910 <+5544991422910>

XL SOLUTIONS
www.xlsol.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180126/b6c86c31/attachment.html>