https://wiki.shibboleth.net/confluence/display/IDP4/AuditLoggingConfiguration Lower case "I" is the assertion ID. Capital "I" is the inbound message ID. Two capitals ("II") is the InResponseTo value. Three capitals ("III") is the outbound message ID. -- Scott