<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Mathias,<div class=""><br class=""></div><div class="">The configuration of an asymmetric encryption credential is currently (in OP 3.3.0) always mandatory. Even if it wasn’t really needed - like in your case.</div><div class=""><br class=""></div><div class="">The security configuration has been refactored heavily for the upcoming OP 3.4.0: there’s no such requirement anymore. The decryption credential is required only if mandated by the configuration for RP. There’ll also be more configuration options for enforcing the use of request objects with varying security configurations.</div><div class=""><br class=""></div><div class="">BR,</div><div class="">Henri.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 20. Apr 2023, at 18.00, Bachl, Mathias via users <<a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class="">Hi,<o:p class=""></o:p></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I tried to configure an IdP with the OIDC OP plugin without any encryption credential, because we do not support authorization request objects neither by value nor by reference, and therefore no encryption key is used in our setup.<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Unfortunately, authorization requests fail with this configuration, because the availability of an encryption credential is checked in PopulateOIDCEncryptionParameters (“Resolver returned no EncryptionParameters”).<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">The parameter “encryptionOptional” is only considered when forDecryption is false (see PopulateOIDCEncryptionParameters#doPreExecute).<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Is there any reason why encryptionOptional cannot be set for decryption? Is there another way to disable checking the presence of an encryption credential?<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Thanks in advance & best regards,<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Mathias<o:p class=""></o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; line-height: 16.866666793823242px; font-size: 11.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>