Unfortunately
the encrypted assertion is not able to be consumed by a
Shibboleth SP. I suspect pysaml2 is doing something non-standard, but I
will have to dig into the XML to understand precisely what...
the encryption is done with xmlsec1
https://github.com/IdentityPython/pysaml2/blob/130776a/src/saml2/sigver.py#…
I suspect it is not the cipher value itself, but rather how pysaml2 is
putting the XML "on the wire". A quick comparison between what a Shib
IdP, a SimpleSAMLphp IdP, and pysaml2 sends shows that the pysaml2
XML result is structurally different.
I have some other things I need to jump into but if I have time I will
try to narrow down the issue...
Thanks,
Scott