Why are you attaching an AttributeEncoder here (or any of the rest of that stuff)? You don't seriously intend to pass this out to an SP, not to mention I think that's the name for sn (last name). I imagine the data you're sourcing isn't encrypted properly in the first place, only the log would say for sure. -- Scott