We receive the principal via a EncryptedID and not as a String. e.g.: <saml2:EncryptedID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_cd52e15a16e2a0aa751725ce76a6b866" Type="http://www.w3.org/2001/04/xmlenc#Element"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /> <ds:KeyInfo> <ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey" URI="#_15531f77a9f1e0b5e0cce442aa31bbd4" /> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>AZkW3hbBaQkxs...</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> <xenc:EncryptedKey Id="_15531f77a9f1e0b5e0cce442aa31bbd4" Recipient="urn:etoegang:..."> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> </xenc:EncryptionMethod> <ds:KeyInfo> <ds:KeyName>...</ds:KeyName> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>yRy923JJlgAi2MTgx1qohLiDBgi...</xenc:CipherValue> </xenc:CipherData> <xenc:ReferenceList> <xenc:DataReference URI="#_cd52e15a16e2a0aa751725ce76a6b866" /> </xenc:ReferenceList> </xenc:EncryptedKey> </saml2:EncryptedID> Is this supported in Mendix? If this is the case what is the correct configuration or direction for this? We use Mendix v8.6.9 with SAML2.0 AppStore-module v2.1.5