<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello <br>
</p>
<p>from
<a class="moz-txt-link-freetext"
href="https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration"
moz-do-not-send="true">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration</a>
I see that I can invalidate encryption for specific SP /entityID :
<br>
</p>
<p><i><bean parent="SAML2.SSO" p:encryptAssertions="false" /></i><br>
</p>
<p>I know it's dirty , but the Vendor I am trying to do SSO with,
not only ask for no encryption (only signing) , but wants the
metadataFile of our IDP to contain only the signing certificat no
occurence of :<br>
</p>
<p><i><KeyDescriptor use="encryption"></i></p>
<p>because it fails their integration tool to have 2 certificates in
metadata<br>
</p>
<p>Is there a way in the configuration of the IDP to completely
invalidate encryption at the point to make it desappear from
Metadata ? <br>
</p>
<p>I tried to comment in credentials.xml <i><br>
</i></p>
<p><i><util:list id="shibboleth.DefaultEncryptionCredentials"></i><i><br>
</i><i> <bean
class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"</i><i><br>
</i><i> p:privateKeyResource="%{idp.encryption.key}"</i><i><br>
</i><i> p:certificateResource="%{idp.encryption.cert}"</i><br>
</p>
<p>but still <i><KeyDescriptor use="encryption"></i> appears
in metadata at <a class="moz-txt-link-freetext"
href="https://myidp.domain.fr/idp/shibboleth"
moz-do-not-send="true">https://myidp.domain.fr/idp/shibboleth</a></p>
<p>Or should I edit myself idp-metadata.xml and "blindly" remove all
the section: <br>
</p>
<p><i> <KeyDescriptor use="encryption"></i><i><br>
</i><i> <ds:KeyInfo></i><i><br>
</i><i> <ds:X509Data></i><i><br>
</i><i> <ds:X509Certificate></i><i><br>
</i><i>MIIDNzCCAh+gAwIBAgIUQ1XYtG2d7w4EbppsM3JMNZNhjIYwDQYJKoZIhvcNAQEL</i><br>
</p>
<p>Thanks . <br>
</p>
<p><br>
</p>
</body>
</html>