SAML cert usage behavior

[IAM David Bantz]

An SP's configuration tool seems unable to enable support for encrypted
assertions even though it does generate a key pair and provides the public
key in cert for the IdP. The cert seems usable for signing their requests,
so we're resigned to deploying without encrypted responses. Will the IdP
honor

  <KeyDescriptor use="signing">

and use the key only for validating the signature on requests - i.e., not
encrypt the response?

Or do I need to explicitly turn off encryption for that SP with a signing
key certificate in the metadata? Is the method described under "Disabling
Encryption" in
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508127/MetadataDrivenConfiguration
appropriate? i.e.,adding along with other metadata-driven attributes


<saml:Attribute Name="http://shibboleth.net/ns/profiles/encryptAssertions"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:
AttributeValue>false</saml:AttributeValue> </saml:Attribute>


David St Pierre Bantz
U Alaska
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250717/ad0d240d/attachment.htm>