Enable signature of the Auth Request. If you enable it the encryption and signing key would available in the SP metadata file and URL (JENKINS_URL/securityRealm/metadata).
        <md:SPSSODescriptor AuthnRequestsSigned="true" ...>