Is there a point for implementing Assertion Level Encryption (and Attribute Level Encryption) if we are already communicating via SSL (https)?
If you're using the browser profile, whereby the SP and IdP exchange messages via the user's browser, SSL alone does not protect against a man-in-the-middle in all cases. Take for example the scenario where a user is on unsecured Wi-Fi and a malicious user intercepts traffic, swapping a self-signed SSL cert for the CA-issued one. If a user clicks through the warning, their transport-level security is negated and confidentiality may be breached. If on the other hand the sensitive parts of the assertion are protected via message level encryption, the man-in-the-middle in the above scenario still cannot read the message despite the user's poor judgement, and confidentiality is ensured.