<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 8, 2018, at 11:34 AM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">* Sam Jacob <<a href="mailto:skjacob@gmail.com" class="">skjacob@gmail.com</a>> [2018-03-08 18:16]:<br class=""><blockquote type="cite" class="">from Scott's post:<br class="">"I investigated, discreetly, a number of SPs that my university has<br class="">campus-wide integrations with and that did not support XML Encryption "<br class=""><br class="">How do you determine an SP that doesn't support XML Encryption?<br class=""></blockquote><br class="">Things to look for:<br class="">An SP with no key in metadatam or with a key that has use="signing".<br class="">A RelyingParty exception for SAML2.SSO with p:encryptAssertions="false".<br class="">A property setting idp.encryption.optional to true (idp.properties or elsewhere).<br class="">-peter<br class="">-- <br class=""></div></div></blockquote><br class=""></div><div>Of course, that last one only impacts encryption if the first one you list (no cert in metadata, or the only cert has use="signing") is true. So another way of summarizing is, if you have:</div><div><br class=""></div><div>- property setting idp.encryption.optional set to true (idp.properties or elsewhere), then the key thing to look at is the metadata you have for each SP, to see if there is a cert (key) than can be used for encryption or not. No cert (key), no encryption.</div><div><br class=""></div><div>- either way, check for any and all RelyingParty exceptions for SAML2.SSO with p:encryptAssertions="false"</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>