SAML Encryption (Encrypted Assertions)

🔐 Encrypted Assertion

Assertions can be encrypted to protect attribute values in transit between IdP and SP.

Why Encrypt?

• ✅ Protects user attributes from being exposed during transit.
• ✅ Helps prevent replay attacks or data leakage.
• ✅ Useful in B2B integrations requiring privacy guarantees.

Requirements for Decryption

• 🔑 The SP must hold a private key to decrypt.
• 🔑 The IdP must have access to the SP’s public key to encrypt.
• 🔑 Check if your SP library supports EncryptedAssertion.

Encrypted Response example

A simple response with an encrypted Assertion (signature omitted, shortened). Even if the XML is intercepted, the encrypted Assertion keeps sensitive data protected.

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_res123" Version="2.0"
    Destination="https://sp.example.com/acs" InResponseTo="_req123">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.example.com/metadata</saml:Issuer>
  <saml:EncryptedAssertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
    <xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
      ...encrypted assertion data...
    </xenc:EncryptedData>
  </saml:EncryptedAssertion>
</samlp:Response>

Metadata example for encryption

Include an encryption KeyDescriptor in SP metadata so the IdP can encrypt assertions with this key.

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sp.example.com/metadata">
  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data><ds:X509Certificate>MIIC... (SP public key) ...</ds:X509Certificate></ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    ...
  </md:SPSSODescriptor>
</md:EntityDescriptor>