Consensus Item Name: NameIDPolicy and ID Encryption

Test Event: SAML Interoperability Test Event 4Q07

Consensus Decision: If NameIDPolicy of AuthnRequest says ID is to be encrypted, it must be encrypted in the assertion and if NameIDPolicy of AuthnRequest does not state the ID is to be encrypted, the IDP MAY still encrypt the ID based on its policy, specifically its policy with the SP.

Background: During testing, a question arose on interpreting NameIDPolicy from [SAMLCore] in lines 2136-2142. The understanding was reached that if NameIDPolicy of AuthnRequest says ID is to be encrypted, it must be encrypted in the assertion and if NameIDPolicy of AuthnRequest does not state the ID is to be encrypted, the IDP MAY still encrypt the ID based on its policy, specifically its policy with the SP.