I already answered this. > we managed to decode it "by hand" with IDP metadata, so why Shibboleth couldn't be able to do that? And what did you get when you decoded it by hand? Not a single Assertion element, I would guess. -- Scott