<div dir="ltr">Peter,<div><br></div><div>Neither. I'm using Shibboleth (both idp and sp) as a reference implementation of SAML2 to test my own product in automated tests.</div><div><br></div><div>Scott,</div><div><br></div><div>I get what you're saying, it's the idp's data so its their responsibility to enforce encryption. I know that its common amongst over saml products to have a flag to require encryption. I've also found it useful if there's a change in configuration on the idp side and something is missed and assertions are no longer encrypted users will experience login failures which will alert the sys admins to the issue. It doesn't stop the leak of information but might stop the bleeding.</div><div><br></div><div>I'm going to open a feature request on the idp, would it be the same place for the sp?</div><div><br></div><div>Thanks</div><div>Marc</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 16, 2015 at 9:31 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 3/15/15, 11:32 PM, "Marc Boorshtein" <<a href="mailto:mboorshtein@gmail.com">mboorshtein@gmail.com</a>> wrote:<br>
<br>
>On apache 2.2 on CentOS 6.x. I have encrypted assertions working, but I can't figure out how to enforce that only encrypted assertions are allowed.<br>
<br>
</span>It isn't really treated as the SP's "concern" since the data doesn't belong to it, and I don't believe I ever included any setting like that.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>