Is it more common for SP or IdP to dictate if assertions should be encrypted?

[Boyd, Todd M.]

One way to do this would be through the use of the KeyDescriptor’s “use” attribute (such as “signing” and “encryption”). If they have a KeyDescriptor specifically called out for “encryption”, it’s probably a safe bet that they support/expect it.

-Todd

From: users <users-bounces at shibboleth.net> On Behalf Of Cody Carmichael
Sent: Tuesday, February 12, 2019 4:18 PM
To: Shib Users <users at shibboleth.net>
Subject: Is it more common for SP or IdP to dictate if assertions should be encrypted?

I'm working with a client engineer who says that his IdP looks to the SP metadata to see if assertions should be encrypted. I'm seeing some ways for how to do this in the SP metadata like
<Attribute name="wantAssertionEncrypted">
Value></Value>

 Or
WantAssertionsEncrypted="true"

 I don't know if one of these is more correct than the other. But is it typical for SPs to drive this? Or is this more typically a configuration on the IdP end?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190212/595652d6/attachment.html>