<div dir="ltr"><div><div>I&#39;m trying to configure our IdP to work with a third-party SP (ArcGIS Online, if that&#39;s of concern).  Their instructions state the following:<br><br><ol><li id="ESRI_STEP_FE9B78AC5A69473F8CE9A73284E86741">
<span id="GUID-C6345BDC-C24B-4A77-B21B-86D59642704F">Turn off assertion encryption in the Shibboleth IdP.</span><div class=""><p id="GUID-111D08B5-6038-4A5D-8597-36D25231D311">ArcGIS
 Online does not support encrypted SAML assertions from the identity 
providers, so you need to turn off assertion encryption in Shibboleth.</p><div class=""><p id="GUID-540186F7-BB1C-4FD8-A55E-90AC31D550B7">To turn off assertion encryption, open the <span class="">SHIBBOLETH_HOME/conf/relying-party.xml</span> file and within the <span class="">&lt;DefaultRelyingParty&gt;</span><span class="">&quot;saml: SAML2SSOProfile&quot;</span> section, change the value of <span class="">encryptAssertions</span> to <span class="">never</span>.</p>
</div><div class=""><pre><code>&lt;rp:DefaultRelyingParty provider=&quot;<a href="https://grid3.esri.com/idp/shibboleth">https://grid3.esri.com/idp/shibboleth</a>&quot;
defaultSigningCredentialRef=&quot;IdPCredential&quot;&gt;
...  
     &lt;rp:ProfileConfiguration xsi:type=&quot;saml:SAML2ECPProfile&quot; includeAttributeStatement=&quot;true&quot; 
                                 assertionLifetime=&quot;PT5M&quot; assertionProxyCount=&quot;0&quot; 
                                 signResponses=&quot;never&quot; signAssertions=&quot;always&quot; 
                                 encryptAssertions=&quot;never&quot; encryptNameIds=&quot;never&quot;/&gt;
...
&lt;/rp:DefaultRelyingParty&gt;
</code></pre></div>
</div></li></ol><br></div>My first issue is that it seems to be talking about two different profiles:  SAML2SSOProfile and SAML2ECPProfile.  I assumed it meant make the changes to the SAML2ECPProfile and I added the following to my relying-party.xml file within the DeffaultRelyingParty section:<br>
<br>&lt;rp:ProfileConfiguration xsi:type=&quot;saml:SAML2ECPProfile&quot;<br>                              includeAttributeStatement=&quot;true&quot;<br>                              assertionLifetime=&quot;PT5M&quot;<br>
                              assertionProxyCount=&quot;0&quot;<br>                              signResponses=&quot;never&quot;<br>                              signAssertions=&quot;always&quot;<br>                              encryptAssertions=&quot;never&quot;<br>
                              encryptNameIds=&quot;never&quot; /&gt;<br><br></div>However, when I restart tomcat I get the error<br><br>14:02:13.259 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:187] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creating components.  The root cause of this error was: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve &#39;saml:SAML2ECPProfile&#39; to a type definition for element &#39;rp:ProfileConfiguration&#39;.<br clear="all">
<div><div><div><br></div><div>which results in a host of java errors.  I have not modified the handler.xml file and as such there is no SAML2ECPProfile section in that file.  However, since that file is so rarely modified, I did not think that was the root cause.<br>
<br></div><div>Any help or suggestions you could provide will be greatly appreciated.<br><br></div><div>Mike<br><br></div><div>-- <br>#####################<br>Michael Dahlberg<br>Systems Integrator<br>Bucknell University<br>
(570) 577-1595<br>#####################<br>
</div></div></div></div>