I would like to make sure that SAML login is secure. Company mandates to sign and encrypt SAML, and most of the assertions are encrypted and signed already, although I have received an answer from a well known auth provider, when I asked about AuthnRequest encryption (federated).
After discussing it with our team and doing extensive research, we couldn't find any functional way to encrypt the SAML Authentication Request. We can encrypt the response when we are the IDP, but it doesn't appear that encrypting the Request is something we support. Can I ask, what information in the request are you hoping to encrypt? Most of the details in an AuthN request need to be accessible in the browser to allow for the exchange to occur.
After the reply, I have some doubts. My question: Does it make sense to encrypt AuthnRequests?