encrypt assertion with static AES key

[Paul B. Henson]

Sooooo, in this week's episode of vendor stupidity, I've got a company
telling me I need to hardcode a static AES key in my idp and use that to
encrypt the assertion rather than using the certificate in the metadata
(which evidently despite having no tags is only intended for their use
for signing, and not for the idp to use to encrypt with).

As far as I can tell, there is no definition in the SAML spec for using
a hardcoded AES key? Am I missing something? Even if I did want to try
and do this, which obviously I don't, there's no way to actually
configure it? And if some random commercial idp does allow it, that idp
is technically not performing SAML but rather a mutated non-compliant
variation of it?

BTW, in order to shame the guilty the product in question is Blue from
Explorance. Interestingly, we already had a perfectly functional
integration with them, but they're "upgrading" their SAML support, and
we're running into this issue trying to stand up their dev platform...


-- 
Paul B. Henson | Operating Systems and Network Analyst
henson at cpp.edu | California State Polytechnic University Pomona