Federation Security Services Guide › Identify Service Providers for a SAML 2.0 Identity Provider › Encrypt a NameID and an Assertion

Encrypt a NameID and an Assertion

You can encrypt the Name ID in an assertion and/or the assertion itself. Encryption adds another level of protection when transmitting the assertion.

When you configure encryption, you must specify the partner certificate, which is included in the assertion. When the assertion arrives at the Service Provider, the Service Provider decrypts the encrypted data using the associated private key.

Note: If you have enabled encryption, when the first federation call is made, the memory of the Policy Server may increase substantially to load the encryption libraries and allocate additional memory.