I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today:
User logs on to their Intranet site and clicks on a link to our company. They use PingFederate Single Sign-On (SSO) to generate the SAML2 request. They send the username in the
Subject.NameId section. When we receive the SAML2 request, we decrypt the information that they sent using their certificate.
The change that they want is to encrypt the section using our key and we will decrypt this section on our side. This is being used just for a one-sided SSO process, and we don't need to send anything back to them.
I just wanted to reach out and see if this is the correct way of doing SAML2 or not. The way that I have it setup is I look at incoming SAML2 request and determine what certificate to use that is on our server, and use what the customer has given to us. Another thing that he said is that the way that we have this implemented is not really SAML2.