SAML encryption

[Mak, Steve]

Typo fix: <bean parent="SAML2.SSO" … p:encryptAssertions="false"…/>

From: users <users-bounces at shibboleth.net> on behalf of "Mak, Steve" <makst at upenn.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, October 8, 2020 at 08:45
To: Shib Users <users at shibboleth.net>
Subject: Re: SAML encryption

There would be zero value to sending out a SAML assertion encrypted with the IdP pub cert when the only party that could decrypt/read it would be the IdP.

Try setting in conf/idp.properties the setting 'idp.encryption.optional = true'.
Try adding to your DefaultRelyingParty config:
  <bean parent="SAML2.SSO" … p:encryptAssetions="false"…/>

From: users <users-bounces at shibboleth.net> on behalf of Ramkumar Ramsubbu <ramkumar.ramsubbu.consultant at nielsen.com>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, October 8, 2020 at 08:37
To: Alan Buxey <alan.buxey at myunidays.com>, Shib Users <users at shibboleth.net>
Subject: Re: SAML encryption

Thanks Alan for your quick response.

Just to verify, we tried to comment all the key sections in the SP Vendor metadata file. Even then the SAML assertion was encrypted. That raised my doubt if IDP's key is used to encrypt.

Thanks,
Ramkumar Ramasubbu
CPS



On Thu, Oct 8, 2020 at 6:00 PM Alan Buxey <alan.buxey at myunidays.com<mailto:alan.buxey at myunidays.com>> wrote:
hi,
>
> I am new to SSO implementation. We have a scenario for IDP initiated SSO. We shared the metadata information with our SP & we updated SP metadata in our idp.
> When generating the SAML response, we see SAML assertions are encrypted inside the cipher data tags. I have very basic question here.
>
> 1. Which key is used by SSO to encrypt the saml assertion in the response. Is it IDP metadata key or the public key from vendor metadata ?
> 2. We tried to decrypt with an idp private key using an online tool ,we got XML parse error.  Is there any way to decrypt the saml assertions we generate ?


its PKI - so its encrypted in the only way that the SP can be the only
one to read it - using the public key from the vendor metadata. only
the SP, with their private key at the the other end, can decrypt it

alan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201008/7078e5dc/attachment.htm>