> Any help appreciated. In addition to Peter's excellent (as always) advice I'd suggest that you turn up logging to debug for net.shibboleth.idp.attribute.resolver and possible for ldaptive. Either do it in logback.xml or via the properties idp.loglevel.idp and idp.loglevel.ldap /Rod