> Ldap will not authenticate because & is one of the 5 xml reserved characters and IdP is not passing the value . To fix it, one need to include an escape "amp;" (no quote) before & symbol in ldap principalCredential Just wondering out loud since I had it wrong last time: would CDATA wrapping here do this encoding for you?