<div dir="ltr"><div><div><div>I have a question about Idp response ,what i understand is the Idp send the SAML response with an encrypted assertion and one public key sent with the same response (public key of SP ) .<br><br></div>what is someone else create one reponse with an  encrypted assertion(manually)  and send it into an Idp .<br></div>second question , why is it important to send the public key within the response.<br><br></div>can anyone help me to understand this chain ?<br><div><div><div><div><div><div><div><br><br><br><br>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;saml2p:Response 
xmlns:saml2p=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; 
Destination=&quot;<a href="http://sp.example.com/Shibboleth.sso/SAML2/POST">http://sp.example.com/Shibboleth.sso/SAML2/POST</a>&quot; 
ID=&quot;_a5fb1e00ce28b5d978fdbc96ff12d047&quot; 
InResponseTo=&quot;_3038953c889f6818dbe819d1780c0a70&quot; 
IssueInstant=&quot;2015-02-12T15:50:44.980Z&quot; Version=&quot;2.0&quot;&gt;<br>   
&lt;saml2:Issuer xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; 
Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:entity&quot;&gt;<a href="https://idp.example.com/idp/shibboleth">https://idp.example.com/idp/shibboleth</a>&lt;/saml2:Issuer&gt;<br>   &lt;saml2p:Status&gt;<br>      &lt;saml2p:StatusCode Value=&quot;urn:oasis:names:tc:SAML:2.0:status:Success&quot;/&gt;<br>   &lt;/saml2p:Status&gt;<br>   &lt;saml2:EncryptedAssertion xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;&gt;<br>     
 &lt;xenc:EncryptedData xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot; 
Id=&quot;_b63280d236530ffc78f01fc91794c86f&quot; 
Type=&quot;<a href="http://www.w3.org/2001/04/xmlenc#Element">http://www.w3.org/2001/04/xmlenc#Element</a>&quot;&gt;<br>         
&lt;xenc:EncryptionMethod 
Algorithm=&quot;<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>&quot; 
xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot;/&gt;<br>         &lt;ds:KeyInfo xmlns:ds=&quot;<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>&quot;&gt;<br>            &lt;xenc:EncryptedKey Id=&quot;_4c5205782b18e2bd90270b1b0c620562&quot; xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot;&gt;<br>              
 &lt;xenc:EncryptionMethod 
Algorithm=&quot;<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>&quot; 
xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot;&gt;<br>                  
&lt;ds:DigestMethod Algorithm=&quot;<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>&quot; 
xmlns:ds=&quot;<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>&quot;/&gt;<br>               &lt;/xenc:EncryptionMethod&gt;<br>               &lt;ds:KeyInfo&gt;<br>                  &lt;ds:X509Data&gt;<br>                     &lt;ds:X509Certificate&gt; Certificate &lt;/ds:X509Certificate&gt;<br>                  &lt;/ds:X509Data&gt;<br>               &lt;/ds:KeyInfo&gt;<br>               &lt;xenc:CipherData xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot;&gt;<br>                 
 
&lt;xenc:CipherValue&gt;XGGQEqxA1YIGAsthbRnKn8i5n2lMPmYYCBufKmoibbYlFApJh5+h8H01xQ+2wr3uBtBQQwVJzf7vNBFyClHX0hWfQMY0t4NRkGKzFpcY0Aki+lzZMVgm245xNmLRrwOLtb57cNJlh3E2FgjBwEXJHTBIffFa6P75FQq+qCPWfhM=&lt;/xenc:CipherValue&gt;<br>               &lt;/xenc:CipherData&gt;<br>            &lt;/xenc:EncryptedKey&gt;<br>         &lt;/ds:KeyInfo&gt;<br>         &lt;xenc:CipherData xmlns:xenc=&quot;<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>&quot;&gt;<br>            &lt;xenc:CipherValue&gt;<br>Encrypted assertion<br>&lt;/xenc:CipherValue&gt;<br>         &lt;/xenc:CipherData&gt;<br>      &lt;/xenc:EncryptedData&gt;<br>   &lt;/saml2:EncryptedAssertion&gt;<br>&lt;/saml2p:Response&gt;<br clear="all"><br><br clear="all"><br></div></div></div></div></div></div></div></div>