SLO Logout Propagation error - Resolver returned no EncryptionParameters

[Lipscomb, Gary]

Hi Scott,

A little confused
Looking at the documentation
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631693/SAML2LogoutConfiguration 
Options common to SAML 2.0 profiles
	NAME			Type		Default	Description
	encryptionOptional	Boolean	false	Whether to automatically disable encryption if the relying party does not possess a suitable key

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration
	Profile		Profile URL
	SAML2.Logout	http://shibboleth.net/ns/profiles/saml2/logout
	
From the above I assumed 

        <saml:Attribute Name=http://shibboleth.net/ns/profiles/saml2/logout/encryptionOptional NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">true</saml:AttributeValue>
        </saml:Attribute>

Was valid syntax to use in the metadata

Regards

Gary

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Monday, 7 February 2022 15:10
To: Shib Users <users at shibboleth.net>
Cc: Lipscomb, Gary <glipscomb at csu.edu.au>
Subject: Re: SLO Logout Propagation error - Resolver returned no EncryptionParameters

>    The vendor in question doesn’t have an encryption key in their 
> metadata so I have added encryptionOptional into the metadata [2]

The optional setting is a Java property, not a profile setting, there is no such tag by that name. If you want to tag it, you would have to apply a tag to set encryptNameID=false for it to affect a logout.

The actual property affects everything and is not specific to any one SP or use case, it's all or nothing.

-- Scott