SAML 1 TransientID Canonicalization

[Cantor, Scott]

On 2/3/17, 3:18 AM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at sudonym.me> wrote:

> Logs are contiguous from a single node.  There are multiple nodes in the 
> pool, but we got this to fail consistently, not 67% of the time.

Maybe the secret key was out of sync, but there should be more logging than what you posted no matter what the cause was.

I don't really understand the questions you had around why this is about subject canonicalization but I can try and answer if I know what you're confused about. I think the documentation on the feature is quite extensive and complete.

-- Scott