I'm using a Shibboleth IDP to authenticate to Salesforce as the service provider. My desired implementation would be to have the IDP encrypt the SAML Assertion AND provide the identity (salesforce user id) as an attribute.
I can get either to work individually but not both at the same time.
By this I mean that if I have the IDP use the salesforce logon id as the 'principal' and therefore configure the SAML Single Sign-On Setting for SAML Identity Location as Identity is in the NameIdentifier element of the Subject statement; I can 'single sign on' to salesforce with an encrypted assertion.
If I configure the IDP to use a different 'principal' (meaning the id the IDP knows the user as), and add the salesforce login id as an Attribute, and configure the SAML Single Sign-On Setting as Identity is in an Attribute element; I can only successfully 'single sign on' if the IDP is not encrypting the Assertion.
With both Assertion Decryption on, and using Identity is in an Attribute element; the IDP seems to think everything worked fine (only successful log messages), but I get the error in my browser:
Login Error Your login attempt using single sign-on with an identity provider certificate has failed. Please contact your salesforce.com administrator for more information.
The Salesforce user login history doesn't show the failed attempt (or anything). The SAML Validator appears to show that everything in the SAML Response/Assertion was 'OK'.
I got a hint that the user identity must be in the Subject element of the assertion from this page of release notes from salesforce:
Finally the question: Does anyone know if I can do both Identity as an Attribute and Encrypted Assertions as part of the same config? I really need to encrypt the assertion and not have to have my IDP use the salesforce login id as the principal on the assertion.