Shibboleth Developers

["Tom Scavo" <>]

On 10/31/07, Chad La Joie 
<>
 wrote:
>
> Tom Scavo wrote:
> >
> > 1. The IdP asserts an SSO assertion with the following characteristics:
> >   * The assertion is unencrypted
> >   * There is a digital signature on the <Assertion> element
> >   * The <AuthnContext> element distinguishes between two levels of 
> > assurance
> >   * The IdP asserts a persistent, non-reassignable identifier (encrypted)
> >   * The assertion may contain non-identity attributes such as ePSA 
> > (unencrypted)
> >
> > * Can the Shib IdP 2.0 be made to issue such an assertion?
>
> Yes.  Generally though, I imagine most people will encrypt the assertion
> if they're pushing attributes in it.

Thanks for the reply.  The above assertion doesn't expose the user's
identity so it seems harmless.  In any event, will the Shib IdP 2.0
encrypt the NameID and Attribute elements selectively (i.e., on a
case-by-case basis).

Thanks,
Tom