SAML encryption

[Ramkumar Ramsubbu]

Thanks a lot Steve.

Thanks,
Ramkumar Ramasubbu
CPS



On Thu, Oct 8, 2020 at 6:18 PM Mak, Steve <makst at upenn.edu> wrote:

> Typo fix: <bean parent="SAML2.SSO" … p:encryptAssertions="false"…/>
>
>
>
> *From: *users <users-bounces at shibboleth.net> on behalf of "Mak, Steve" <
> makst at upenn.edu>
> *Reply-To: *Shib Users <users at shibboleth.net>
> *Date: *Thursday, October 8, 2020 at 08:45
> *To: *Shib Users <users at shibboleth.net>
> *Subject: *Re: SAML encryption
>
>
>
> There would be zero value to sending out a SAML assertion encrypted with
> the IdP pub cert when the only party that could decrypt/read it would be
> the IdP.
>
>
>
> Try setting in conf/idp.properties the setting 'idp.encryption.optional =
> true'.
>
> Try adding to your DefaultRelyingParty config:
>
>   <bean parent="SAML2.SSO" … p:encryptAssetions="false"…/>
>
>
>
> *From: *users <users-bounces at shibboleth.net> on behalf of Ramkumar
> Ramsubbu <ramkumar.ramsubbu.consultant at nielsen.com>
> *Reply-To: *Shib Users <users at shibboleth.net>
> *Date: *Thursday, October 8, 2020 at 08:37
> *To: *Alan Buxey <alan.buxey at myunidays.com>, Shib Users <
> users at shibboleth.net>
> *Subject: *Re: SAML encryption
>
>
>
> Thanks Alan for your quick response.
>
>
>
> Just to verify, we tried to comment all the key sections in the SP Vendor
> metadata file. Even then the SAML assertion was encrypted. That raised my
> doubt if IDP's key is used to encrypt.
>
>
> Thanks,
>
> Ramkumar Ramasubbu
>
> CPS
>
>
>
>
>
>
>
> On Thu, Oct 8, 2020 at 6:00 PM Alan Buxey <alan.buxey at myunidays.com>
> wrote:
>
> hi,
> >
> > I am new to SSO implementation. We have a scenario for IDP initiated
> SSO. We shared the metadata information with our SP & we updated SP
> metadata in our idp.
> > When generating the SAML response, we see SAML assertions are encrypted
> inside the cipher data tags. I have very basic question here.
> >
> > 1. Which key is used by SSO to encrypt the saml assertion in the
> response. Is it IDP metadata key or the public key from vendor metadata ?
> > 2. We tried to decrypt with an idp private key using an online tool ,we
> got XML parse error.  Is there any way to decrypt the saml assertions we
> generate ?
>
>
> its PKI - so its encrypted in the only way that the SP can be the only
> one to read it - using the public key from the vendor metadata. only
> the SP, with their private key at the the other end, can decrypt it
>
> alan
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201008/a3a3f660/attachment.htm>