<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Jan,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://wiki.shibboleth.net/confluence/display/SP3/AssertionExport">https://wiki.shibboleth.net/confluence/display/SP3/AssertionExport</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <span style="color:black">What I’m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used
(and by whom).</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I want to remind you that the encryption that an IdP uses will be something it picks from your service's supported encryption algos which will be listed in
<b>your</b> SP metadata… so if you want to strike an algo off your list you would simply update your sp metadata and communicate that change to the IdP. At least that's what it's there for. I'm not sure if you're implying that IdPs simply pick whatever they
want and that's not always the case. <b>Your</b> SP metadata provides them with the encryption cert to use and the supported algos and the IdP builds from that menu. So, the only thing you'd be really auditing is your own config.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Steve<o:p></o:p></p>
</div>
</body>
</html>