> SP's transaction.log showing only persistent-id coming through: After filtering, yes. If something's filtered you won't see it there, so check the shibd log. Most likely your IdP metadata has no Scope extension in it, so the default rules for EPPN are filtering it. -- Scott