<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1454421906039_67891">Greetings Shib Users,</div><div id="yui_3_16_0_1_1454421906039_67905"><br></div><div dir="ltr" id="yui_3_16_0_1_1454421906039_67908"> I'm new to shib so my understanding is evolving by the hour, so if I make no sense with my questions please bear with me.</div><div id="yui_3_16_0_1_1454421906039_67944" dir="ltr"><br></div><div id="yui_3_16_0_1_1454421906039_67943" dir="ltr"> I'm having a problem authenticating to an SP who's service we've contracted. When I had idp.encryption.optional set to false, we got the error <span id="yui_3_16_0_1_1454421906039_67986" class=""> <br></span></div><div id="yui_3_16_0_1_1454421906039_68013" dir="ltr"><span id="yui_3_16_0_1_1454421906039_67986" class=""><br></span></div><div id="yui_3_16_0_1_1454421906039_68012" dir="ltr"><span id="yui_3_16_0_1_1454421906039_67986" class="">SAML failed to login, Status code is
urn:oasis:names:tc:SAML:2.0:status:Responder. When it is supposed to be urn:oasis:names:tc:SAML:2.0:status:Success</span></div><div id="yui_3_16_0_1_1454421906039_68015" dir="ltr"><br><span id="yui_3_16_0_1_1454421906039_67986" class=""></span></div><div id="yui_3_16_0_1_1454421906039_68028" dir="ltr"><span id="yui_3_16_0_1_1454421906039_67986" class=""> When I set </span>idp.encryption.optional to true I can authenticate against my Shib server but then it looks like NameID is coming through encrypted. I see a value that looks like "|AAhzZWNyZXQyM0d3l9SkgTcyhW0EIFydZAtaItLmybSzB0mgY1T+cxMB+mJ0BlUBwc96n6RtkPb2HMuWxucuUTEKziIJj6lXr4U6dx8G5TwsYIJ3ACiuowj8KgiW07voQ7Xy948b2DZDmyBhw1Cojjw="</div><div dir="ltr"><br></div><div id="yui_3_16_0_1_1454421906039_68080" dir="ltr">Based on some reading I've done it appears that NameID is encrypted if end to end encryption can't be assured, so it looks like I have 2 possible solutions, one is to figure out how to insure end to end is encrypted, the other would be to set it so I can send NameID in clear text.</div><div id="yui_3_16_0_1_1454421906039_68122" dir="ltr"><br></div><div dir="ltr"> I'm at a loss how to do either, can someone guide me?</div><div dir="ltr"><br></div><div dir="ltr">Thanks</div><div dir="ltr">-Bob<br></div><div id="yui_3_16_0_1_1454421906039_67906">--<br></div><div id="yui_3_16_0_1_1454421906039_67882">Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div></body></html>