<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>For Oracle Weblogic SAML integrations, we also needed to adjust
how the SAML response is generated. We use this in
relying-party.xml:</p>
<p> <!-- turn off encryption, sign assertions not
responses, sign with SHA1, use alt nameid --><br>
<bean parent="RelyingPartyByName"
c:relyingPartyIds=<a class="moz-txt-link-rfc2396E" href="https://sp.example.org/">"https://sp.example.org/"</a>><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"
p:encryptAssertions="false"<br>
p:signResponses="false"
p:signAssertions="true"<br>
p:securityConfiguration-ref="SHA1SecurityConfig"<br>
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/><br>
</list><br>
</property><br>
</bean><br>
</p>
<p>You might not need the nameIDFormatPrecedence setting if you're
using the modern v3 methods for nameID generation.<br>
</p>
<br>
<div class="moz-cite-prefix">On 1/24/2018 6:44 PM, Rafael Peroco
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAKVosUtv0N+EU+Go=5a=OH9PvUy65mDSE=WiRr4MosLch24tWw@mail.gmail.com">
<div dir="ltr">Nate,
<div><br>
</div>
<div>Thank you for your answer.</div>
<div><br>
</div>
<div>I've followed your instructions but keep getting "400 Bad
request" from SP. </div>
<div><br>
</div>
<div>For confirmation, I set:</div>
<div>idp.encryption.optional = true<br>
</div>
<div><br>
</div>
<div>Is that right?</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">Em qua, 24 de jan de 2018 às 21:53, Klingenstein,
Nate <<a href="mailto:nklingenstein@calstate.edu"
moz-do-not-send="true">nklingenstein@calstate.edu</a>>
escreveu:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div class="m_-3037115587284591960WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Rafael,</span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">You
need to set encryption to be optional using
idp.properties. That won’t disable it, but it will
allow the IdP to send assertions that are not
encrypted if there is also no key available for
encryption to that service provider.</span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Between
that setting and ensuring there is no encryption key,
you should be set.</span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Take
care,</span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Nate.</span></p>
<p class="MsoNormal"><a
name="m_-3037115587284591960__MailEndCompose"
moz-do-not-send="true"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span></a></p>
<span></span>
<p class="MsoNormal"><b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">
users [mailto:<a
href="mailto:users-bounces@shibboleth.net"
target="_blank" moz-do-not-send="true">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Rafael Peroco<br>
<b>Sent:</b> Wednesday, January 24, 2018 3:45 PM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net"
target="_blank" moz-do-not-send="true">users@shibboleth.net</a><br>
<b>Subject:</b> Disable encryption on SAML response</span></p>
</div>
</div>
<div link="blue" vlink="purple" lang="EN-US">
<div class="m_-3037115587284591960WordSection1">
<p class="MsoNormal"> </p>
<p class="MsoNormal">Is there a way to disable the SAML
response encryption?</p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">The SP side (Oracle) is saying that
need response without cryptography.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Thanks</p>
</div>
<p class="MsoNormal"><br clear="all">
<br>
-- </p>
<div>
<div>
<p class="MsoNormal"><b><span
style="font-size:16.0pt;font-family:"Calibri",sans-serif;color:black">RAFAEL
PEROCO</span></b></p>
<div>
<div>
<p class="MsoNormal"><span
style="font-size:13.5pt;font-family:"times",serif;color:black"><a
href="tel:+551142100550" target="_blank"
moz-do-not-send="true"><span
style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;text-decoration:none">+55
11 4210-0550</span></a></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:13.5pt;font-family:"times",serif;color:black"><a
href="tel:+552120181310" target="_blank"
moz-do-not-send="true"><span
style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;text-decoration:none">+55
21 2018-1310</span></a></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:13.5pt;font-family:"times",serif;color:black"><a
href="tel:+5544991422910" target="_blank"
moz-do-not-send="true"><span
style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;text-decoration:none">+55
44 99142-2910</span></a></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:13.5pt;font-family:"times",serif;color:black"> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:19.0pt;font-family:"Calibri",sans-serif;color:#00acc9">XL<span
class="m_-3037115587284591960inbox-inbox-inbox-apple-converted-space"> </span></span><span
style="font-size:19.0pt;font-family:"Calibri",sans-serif;color:#a7a7a7">SOLUTIONS</span><span
style="font-size:13.5pt;font-family:"times",serif;color:black"></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:13.5pt;font-family:"times",serif;color:black"><a
href="http://www.xlsol.com" target="_blank"
moz-do-not-send="true"><span
style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;text-decoration:none">www.xlsol.com</span></a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div link="blue" vlink="purple" lang="EN-US">
</div>
--<br>
For Consortium Member technical support, see <a
href="https://wiki.shibboleth.net/confluence/x/coFAAg"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a
href="mailto:users-unsubscribe@shibboleth.net"
target="_blank" moz-do-not-send="true">users-unsubscribe@shibboleth.net</a></blockquote>
</div>
-- <br>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr"><span
style="color:rgb(0,0,0);font-family:calibri;font-size:16pt;font-weight:bold">RAFAEL
PEROCO</span><span
style="color:rgb(0,0,0);font-family:times;font-size:medium"></span>
<div
style="color:rgb(0,0,0);font-family:times;font-size:medium">
<div><a href="tel:+551142100550"
style="font-family:calibri;font-size:12pt;color:rgb(0,0,0);text-decoration:none"
moz-do-not-send="true">+55 11 4210-0550</a></div>
<div><a href="tel:+552120181310"
style="font-family:calibri;font-size:12pt;color:rgb(0,0,0);text-decoration:none"
moz-do-not-send="true">+55 21 2018-1310</a></div>
<div><a href="tel:+5544991422910"
style="font-family:calibri;font-size:12pt;color:rgb(0,0,0);text-decoration:none"
moz-do-not-send="true">+55 44 99142-2910</a></div>
<div><span style="font-family:calibri;font-size:12pt"><br>
</span></div>
<div><span
style="font-family:calibri;font-size:19pt;color:rgb(0,172,201)">XL<span
class="inbox-inbox-inbox-Apple-converted-space"> </span></span><span
style="font-family:calibri;font-size:19pt;color:rgb(167,167,167)">SOLUTIONS</span></div>
<div><a href="http://www.xlsol.com"
style="font-family:calibri;font-size:12pt;color:rgb(0,0,0);text-decoration:none"
moz-do-not-send="true">www.xlsol.com</a></div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>