Shibboleth SP 500 after processing valid SAML response and assertion
Thomas Blanchard
tblanchard at linkedin.com
Mon Oct 1 20:36:58 EDT 2018
Cantor, Scott cantor.2 at osu.edu <mailto:users%40shibboleth.net?Subject=Re:%20Re%3A%20Shibboleth%20SP%20500%20after%20processing%20valid%20SAML%20response%20and%0A%20assertion&In-Reply-To=%3C6C0AA522-4850-4783-A999-27F22C6BBA32%40osu.edu%3E>
Mon Oct 1 14:16:39 EDT 2018
> As mentioned, since the Assertion and Response are SAML-valid, I would expect an error in the logs if there is an issue
> with the coherence of the request. I'm looking for any suggestion to the investigate further this issue.
I would be very surprised if nothing is logged but be that as it may I think the problem is the OneTimeUse Condition in there, which is not processed/accepted by the default policy rules the SP ships with.
-- Scott
Thank you Scott, after the customer changed the time on its server for testing purposes, we figured out that their AuthnInstant in the AuthnStatement had 1h difference with the Response and Assertion's IssueInstant.
It looks like in this case, the SP did not emit any error or warning, but simply dropped the assertion. Is this expected behavior ? Can I assume that when no error or warning is in the logs, then the issue is in the coherence of the response ? Or is it such an edge case that this is not dealt with in the logs ?
Here are the logs' timestamps for reference:
2018-10-01 11:45:43-0700 DEBUG OpenSAML.MessageDecoder.SAML2POST [10]: decoded SAML message:
saml2p:Response IssueInstant="2018-10-01T18:43:57.389Z"
saml2:Assertion IssueInstant="2018-10-01T18:43:51.928Z"
saml2:SubjectConfirmationData NotOnOrAfter="2018-10-01T19:48:51.928Z"
AuthnStatement AuthnInstant="2018-10-01T19:43:51.928Z" SessionNotOnOrAfter="2018-10-01T19:58:51.928Z">
We managed to test a successful login by fiddling with test servers' time to confirm this is the issue.
Thomas
--
Thomas Blanchard
LinkedIn Learning & Lynda SRE
________________________________
From: Thomas Blanchard
Sent: Monday, October 1, 2018 13:58
To: users at shibboleth.net
Subject: Shibboleth SP 500 after processing valid SAML response and assertion
Hello everyone,
I'm having a really troubling issue with a customer getting 500 during the SAML Response processing after passing a valid Response and Assertion (I validated both the whole response and the assertion using samltools.com).
The customer is not using an IdP but a SAML assertion generator which is sent to the SP. The SAML response and assertion is valid but Shibboleth is returning a 500 for the /SAML2/POST instead of creating a session and redirecting the user to the service (lynda.com in this case).
This was working with the previous version of our Shibboleth SP (2.3.1) but it's not working after we upgraded our SP to shibboleth version 2.6.4.1 (upgrade to 3.0.2 planned).
As mentioned, since the Assertion and Response are SAML-valid, I would expect an error in the logs if there is an issue with the coherence of the request. I'm looking for any suggestion to the investigate further this issue.
Our shibboleth SP DEBUG logs show no error or warning and ends with those 2 messages :
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [42]: signature verified against message issuer
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [42]: assertion satisfied bearer confirmation requirements
I assume the next step is failing but I have no idea what exactly is failling.
(Beginning of logs for this Entity ID, no SAML Request prior)
2018-09-27 10:56:04 DEBUG Shibboleth.Listener [42]: dispatching message (default/SAML2/POST)
2018-09-27 10:56:04 DEBUG OpenSAML.MessageDecoder.SAML2POST [42]: validating input
2018-09-27 10:56:04 DEBUG OpenSAML.MessageDecoder.SAML2POST [42]: decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response
[...output truncated see full content below...]
</saml2p:Response>
2018-09-27 10:56:04 DEBUG OpenSAML.MessageDecoder.SAML2 [42]: extracting issuer from SAML 2.0 protocol message
2018-09-27 10:56:04 DEBUG OpenSAML.MessageDecoder.SAML2 [42]: message from (https://learnnsf.nsf.gov/GP-sp)
2018-09-27 10:56:04 DEBUG OpenSAML.MessageDecoder.SAML2 [42]: searching metadata for message issuer...
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [42]: evaluating message flow policy (replay checking on, expiration 60)
2018-09-27 10:56:04 DEBUG XMLTooling.StorageService [42]: inserted record (_1538070963159) in context (MessageFlow) with expiration (1538072823)
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [42]: validating signature profile
2018-09-27 10:56:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [42]: attempting to validate signature with the peer's credentials
2018-09-27 10:56:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [42]: signature validated with credential
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [42]: signature verified against message issuer
2018-09-27 10:56:04 DEBUG Shibboleth.SSO.SAML2 [42]: processing message against SAML 2.0 SSO profile
2018-09-27 10:56:04 DEBUG Shibboleth.SSO.SAML2 [42]: extracting issuer from SAML 2.0 assertion
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [42]: evaluating message flow policy (replay checking on, expiration 60)
2018-09-27 10:56:04 DEBUG XMLTooling.StorageService [42]: inserted record (_1538070962807) in context (MessageFlow) with expiration (1538072822)
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [42]: validating signature profile
2018-09-27 10:56:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [42]: attempting to validate signature with the peer's credentials
2018-09-27 10:56:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [42]: signature validated with credential
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [42]: signature verified against message issuer
2018-09-27 10:56:04 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [42]: assertion satisfied bearer confirmation requirements
(End of logs for this Entity ID)
Here's the customer's metadata:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" cacheDuration="PT1444927850S" entityID="https://learnnsf.nsf.gov/GP-sp">
<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDrDCCApSgAwIBAgIEVhPszjANBgkqhkiG9w0BAQsFADCBlzEuMCwGCSqGSIb3DQEJARYfaG9z
dGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1EMREw
DwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZHUCBFVFMxGTAXBgNVBAMM
EGxlYXJubnNmLm5zZi5nb3YwHhcNMTUxMDA2MTU0NzA5WhcNNDUxMDA2MTU0NzA5WjCBlzEuMCwG
CSqGSIb3DQEJARYfaG9zdGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMx
CzAJBgNVBAgMAk1EMREwDwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZH
UCBFVFMxGTAXBgNVBAMMEGxlYXJubnNmLm5zZi5nb3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDNQjuStqTUlQVLoBDR5+kuVF7IC6swCg4RO4tc9ZGo0dqUqebc4vyLY72nuMvKQvQw
rR4SVlmmUPi2T03KFJ+P4pUJIk1erTIYk3wAgESYg01R84AraLKDlomln4aXKwvvDT4JRUMO4qpL
LzbAVaIX+wy1mBQtDXKP0Ugx4kY5RahHtUwbEBeog6Owbh1txGlV1+2mzk/m61hhcRVuxfnM/JOF
q/YXCBRJ38sq9XkfJ0+1C8vw4IvyIYuMQNQHRMzexL7G5BfUrRCc3SMUMjN1XrQClDWRhZMSAHp5
9GJBjKSdspCaWHj06qO7DzITsg+nWgKFGLpi6oo1XkuCXm0/AgMBAAEwDQYJKoZIhvcNAQELBQAD
ggEBAKnwT6lw4+kourGD8uowqAiuKX7jLccCm/Ip2rlKI7gp0P0x8bKeTNAJX+vmMMyij00/Htf0
DvirdiC43D6kzJoGm4/NYjQc94LJu+Pehu04rl6btn/fWZtFBR08uLdmHIFBHy6Us2tS5LWCnekt
TlBHTYWnj5yDkk7P+Fnla9uhN3YH52aAmdZwmUo8902TmPMhXuR9B34k/uaLGM2paQtCdACwtf8X
ANNJkLCUTyCgjV3vCuKCdEPwCsQwdmr1DtX3rs/A0jh6nbglcg+B7pJFYHkoBWCOYo6HXCzl1zSe
YfY96WszDLg2NcQm0SxWU/UyJhmZkLhK3J/B9x9vcd8=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDrDCCApSgAwIBAgIEVhPszjANBgkqhkiG9w0BAQsFADCBlzEuMCwGCSqGSIb3DQEJARYfaG9z
dGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1EMREw
DwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZHUCBFVFMxGTAXBgNVBAMM
EGxlYXJubnNmLm5zZi5nb3YwHhcNMTUxMDA2MTU0NzA5WhcNNDUxMDA2MTU0NzA5WjCBlzEuMCwG
CSqGSIb3DQEJARYfaG9zdGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMx
CzAJBgNVBAgMAk1EMREwDwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZH
UCBFVFMxGTAXBgNVBAMMEGxlYXJubnNmLm5zZi5nb3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDNQjuStqTUlQVLoBDR5+kuVF7IC6swCg4RO4tc9ZGo0dqUqebc4vyLY72nuMvKQvQw
rR4SVlmmUPi2T03KFJ+P4pUJIk1erTIYk3wAgESYg01R84AraLKDlomln4aXKwvvDT4JRUMO4qpL
LzbAVaIX+wy1mBQtDXKP0Ugx4kY5RahHtUwbEBeog6Owbh1txGlV1+2mzk/m61hhcRVuxfnM/JOF
q/YXCBRJ38sq9XkfJ0+1C8vw4IvyIYuMQNQHRMzexL7G5BfUrRCc3SMUMjN1XrQClDWRhZMSAHp5
9GJBjKSdspCaWHj06qO7DzITsg+nWgKFGLpi6oo1XkuCXm0/AgMBAAEwDQYJKoZIhvcNAQELBQAD
ggEBAKnwT6lw4+kourGD8uowqAiuKX7jLccCm/Ip2rlKI7gp0P0x8bKeTNAJX+vmMMyij00/Htf0
DvirdiC43D6kzJoGm4/NYjQc94LJu+Pehu04rl6btn/fWZtFBR08uLdmHIFBHy6Us2tS5LWCnekt
TlBHTYWnj5yDkk7P+Fnla9uhN3YH52aAmdZwmUo8902TmPMhXuR9B34k/uaLGM2paQtCdACwtf8X
ANNJkLCUTyCgjV3vCuKCdEPwCsQwdmr1DtX3rs/A0jh6nbglcg+B7pJFYHkoBWCOYo6HXCzl1zSe
YfY96WszDLg2NcQm0SxWU/UyJhmZkLhK3J/B9x9vcd8=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://learnnsf.nsf.gov/GP-sp" />
</md:IDPSSODescriptor>
</md:EntityDescriptor>
Here is the full SAML Response pretty printed and with PII obfuscatd:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://shib.lynda.com/Shibboleth.sso/SAML2/POST" ID="_1538070963159" IssueInstant="2018-09-27T17:56:03.159Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://learnnsf.nsf.gov/GP-sp</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_1538070963159">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>wqrjt3X51bLwPtjXghGl5UomlH0=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>DcAicMO1DwTwxr+gkjN6hi9CfnZCHIhTExDBrhZaHNf/ycxoKnRxF+7D9ZOOpslFFVguOnCKA+inlLVa4pf0j1tEsae4rsX7x5mW465YP+lcyNRY+OnadVvAK0rSjtKmYAPFKSTsEq4M0UN2QS43Oq43oEyhNy4jh8DaysR+foDUkmlpIuneTZ3HQtaOs6HwOOp6x9utKjqtyOQ8xDAvXHGUjM42bv60U9WXMuxfPh0TODMWncw4yFGAtxCMWO5BwRk53ngdJzKBvkodlbSNZwcmdXI6i6JCZqq4uVU2J1/QAj9CtWgJy/6RPiEJ2KaRBhvG5Bd4SavyYqa/MM9j6w==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDrDCCApSgAwIBAgIEVhPszjANBgkqhkiG9w0BAQsFADCBlzEuMCwGCSqGSIb3DQEJARYfaG9z
dGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1EMREw
DwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZHUCBFVFMxGTAXBgNVBAMM
EGxlYXJubnNmLm5zZi5nb3YwHhcNMTUxMDA2MTU0NzA5WhcNNDUxMDA2MTU0NzA5WjCBlzEuMCwG
CSqGSIb3DQEJARYfaG9zdGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMx
CzAJBgNVBAgMAk1EMREwDwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZH
UCBFVFMxGTAXBgNVBAMMEGxlYXJubnNmLm5zZi5nb3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDNQjuStqTUlQVLoBDR5+kuVF7IC6swCg4RO4tc9ZGo0dqUqebc4vyLY72nuMvKQvQw
rR4SVlmmUPi2T03KFJ+P4pUJIk1erTIYk3wAgESYg01R84AraLKDlomln4aXKwvvDT4JRUMO4qpL
LzbAVaIX+wy1mBQtDXKP0Ugx4kY5RahHtUwbEBeog6Owbh1txGlV1+2mzk/m61hhcRVuxfnM/JOF
q/YXCBRJ38sq9XkfJ0+1C8vw4IvyIYuMQNQHRMzexL7G5BfUrRCc3SMUMjN1XrQClDWRhZMSAHp5
9GJBjKSdspCaWHj06qO7DzITsg+nWgKFGLpi6oo1XkuCXm0/AgMBAAEwDQYJKoZIhvcNAQELBQAD
ggEBAKnwT6lw4+kourGD8uowqAiuKX7jLccCm/Ip2rlKI7gp0P0x8bKeTNAJX+vmMMyij00/Htf0
DvirdiC43D6kzJoGm4/NYjQc94LJu+Pehu04rl6btn/fWZtFBR08uLdmHIFBHy6Us2tS5LWCnekt
TlBHTYWnj5yDkk7P+Fnla9uhN3YH52aAmdZwmUo8902TmPMhXuR9B34k/uaLGM2paQtCdACwtf8X
ANNJkLCUTyCgjV3vCuKCdEPwCsQwdmr1DtX3rs/A0jh6nbglcg+B7pJFYHkoBWCOYo6HXCzl1zSe
YfY96WszDLg2NcQm0SxWU/UyJhmZkLhK3J/B9x9vcd8=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_1538070962807" IssueInstant="2018-09-27T17:56:02.807Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer>https://learnnsf.nsf.gov/GP-sp</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_1538070962807">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>t44ltZbuNmwgYNMf+nVf9+Khnkk=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>mH2szsMpcnPoIUJLNKWY59kfn05Ygyn61xsnDN8Duw2+/gsNW0gFQPT9l5HhwgZZquoQqYwN/KGjRTUYPVfMtZVuCnWR6RyG0bq1sM5geb6JR2xsQTWQq5sLLFFj6gOsKjiD+1LHdKTQobuIk42bpknAn/cEy4WRzlIPJnmVE/ggQkqtjPpzr3iefpbUuNYO0piXaoejUWKjyf2DcI8PVrT74HYGVyaAoDzwHBUj5JgfoK5vIrWuJ+pl88LkleEs8kzUmr3wVkw5zmF7C3wk0wV8/WUuHYMVWYrwLnnnZtcXVriaVr0irVzhcwS0vgw7VgsEkxItZDDxeVsojN2r/w==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDrDCCApSgAwIBAgIEVhPszjANBgkqhkiG9w0BAQsFADCBlzEuMCwGCSqGSIb3DQEJARYfaG9z
dGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1EMREw
DwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZHUCBFVFMxGTAXBgNVBAMM
EGxlYXJubnNmLm5zZi5nb3YwHhcNMTUxMDA2MTU0NzA5WhcNNDUxMDA2MTU0NzA5WjCBlzEuMCwG
CSqGSIb3DQEJARYfaG9zdGluZ3N1cHBvcnRAZ3BzdHJhdGVnaWVzLmNvbTELMAkGA1UEBhMCVVMx
CzAJBgNVBAgMAk1EMREwDwYDVQQHDAhDb2x1bWJpYTEMMAoGA1UECgwDTlNGMQ8wDQYDVQQLDAZH
UCBFVFMxGTAXBgNVBAMMEGxlYXJubnNmLm5zZi5nb3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDNQjuStqTUlQVLoBDR5+kuVF7IC6swCg4RO4tc9ZGo0dqUqebc4vyLY72nuMvKQvQw
rR4SVlmmUPi2T03KFJ+P4pUJIk1erTIYk3wAgESYg01R84AraLKDlomln4aXKwvvDT4JRUMO4qpL
LzbAVaIX+wy1mBQtDXKP0Ugx4kY5RahHtUwbEBeog6Owbh1txGlV1+2mzk/m61hhcRVuxfnM/JOF
q/YXCBRJ38sq9XkfJ0+1C8vw4IvyIYuMQNQHRMzexL7G5BfUrRCc3SMUMjN1XrQClDWRhZMSAHp5
9GJBjKSdspCaWHj06qO7DzITsg+nWgKFGLpi6oo1XkuCXm0/AgMBAAEwDQYJKoZIhvcNAQELBQAD
ggEBAKnwT6lw4+kourGD8uowqAiuKX7jLccCm/Ip2rlKI7gp0P0x8bKeTNAJX+vmMMyij00/Htf0
DvirdiC43D6kzJoGm4/NYjQc94LJu+Pehu04rl6btn/fWZtFBR08uLdmHIFBHy6Us2tS5LWCnekt
TlBHTYWnj5yDkk7P+Fnla9uhN3YH52aAmdZwmUo8902TmPMhXuR9B34k/uaLGM2paQtCdACwtf8X
ANNJkLCUTyCgjV3vCuKCdEPwCsQwdmr1DtX3rs/A0jh6nbglcg+B7pJFYHkoBWCOYo6HXCzl1zSe
YfY96WszDLg2NcQm0SxWU/UyJhmZkLhK3J/B9x9vcd8=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">(OBFUSCATED)</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData NotOnOrAfter="2018-09-27T19:01:02.799Z" Recipient="https://shib.lynda.com/Shibboleth.sso/SAML2/POST"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions>
<saml2:OneTimeUse/>
<saml2:AudienceRestriction>
<saml2:Audience>https://shib.lynda.com/shibboleth-sp</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2018-09-27T18:56:02.799Z" SessionNotOnOrAfter="2018-09-27T19:11:02.799Z">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute Name="mail">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"/>
</saml2:Attribute>
<saml2:Attribute Name="sn">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">(OBFUSCATED)</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="givenName">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">(OBFUSCATED)</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
Thank you
Thomas
--
Thomas Blanchard
LinkedIn Learning & Lynda SRE
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181002/6cddba8b/attachment.html>
More information about the users
mailing list