<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thank you Chad, you are correct. I had missed that there is a separate default ServerName for 443 in httpd-ssl.conf. Dang.<div><br></div><div>But now it works! :)</div><div><div><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><strong style="color: rgb(51, 153, 153); "><br class="Apple-interchange-newline">Per Ejeklint</strong></span></div><div><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><strong style="color: rgb(51, 153, 153); "></strong></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">Address: <a href="http://www.heimore.com/" title="visit heimore.com" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Heimore Group AB</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">, Götgatan 78 22th floor, SE-118 30 </span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><a href="http://www.stockholm.se/" title="visit Stockholm" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Stockholm</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">, </span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><a href="http://www.sweden.se/" title="visit Sweden" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Sweden</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><br></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">Phone: +4670-5090052</span></div></div></div></span><br class="Apple-interchange-newline"></span><br class="Apple-interchange-newline">
</div>
<br><div><div>4 maj 2012 kl. 15:19 skrev Chad La Joie:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>What is occurring is the SP is sending an authn request that contains<br>the <a href="http://example.com">example.com</a> hostname. The IdP then checks its metadata (which is<br>viewed as trusted, authoritative information about relying parties to<br>which it communicates) to ensure that the URL given in the request<br>matches the URL in the metadata and that's failing. So it's not the<br>IdP pulling that incorrect URL from metadata, it's the SP giving it to<br>the IdP and the IdP noticing a mismatch from what its supposed to be.<br><br>So, the issue is a SP-environment issues. Specifically, your<br>webserver is probably misconfigured and telling the SP that the<br>hostname of the server is <a href="http://example.com">example.com</a> at the time that SP is<br>constructing that ACS URL.<br><br>On Fri, May 4, 2012 at 9:10 AM, Per Ejeklint <<a href="mailto:per.ejeklint@heimore.com">per.ejeklint@heimore.com</a>> wrote:<br><blockquote type="cite">Hey world, new Shibboleth user here!<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I'm trying to set up a local installation of IdP and SP on the same machine<br></blockquote><blockquote type="cite">(Mac OS X Lion) and have gotten it to work - almost. I stumble upon a<br></blockquote><blockquote type="cite">mismatch in URLs after successfully have logged in with the configured LDAP.<br></blockquote><blockquote type="cite">IDP says<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] -<br></blockquote><blockquote type="cite">Relying party '<a href="https://sp.ejeklint.se/shibboleth'">https://sp.ejeklint.se/shibboleth'</a> requested the response to<br></blockquote><blockquote type="cite">be returned to endpoint with ACS URL<br></blockquote><blockquote type="cite">'<a href="https://www.example.com/Shibboleth.sso/SAML2/POST'">https://www.example.com/Shibboleth.sso/SAML2/POST'</a> and binding<br></blockquote><blockquote type="cite">'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with<br></blockquote><blockquote type="cite">that URL and using a supported binding, can be found in the relying party's<br></blockquote><blockquote type="cite">metadata<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">and that's fair enough as "<a href="https://www.example.com">https://www.example.com</a>..." is not a correct URL.<br></blockquote><blockquote type="cite">But the thing is that I share metadata ONLY through files, and in my<br></blockquote><blockquote type="cite">metadata file for the SP there is not a trace left of "<a href="http://www.example.com">www.example.com</a>" - my<br></blockquote><blockquote type="cite">own machine name is there.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">For some reason the IdP seem to pick the ACS URL from the running SP and not<br></blockquote><blockquote type="cite">from the metadata file I have provided. Now I'm stuck and need a (gentle)<br></blockquote><blockquote type="cite">kick in the right direction.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Here's my metadata tags in RelyingParty.xml:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!-- ========================================== --><br></blockquote><blockquote type="cite"> <!-- Metadata Configuration --><br></blockquote><blockquote type="cite"> <!-- ========================================== --><br></blockquote><blockquote type="cite"> <!-- MetadataProvider the combining other MetadataProviders --><br></blockquote><blockquote type="cite"> <metadata:MetadataProvider id="ShibbolethMetadata"<br></blockquote><blockquote type="cite">xsi:type="metadata:ChainingMetadataProvider"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!-- Load the IdP's own metadata. This is necessary for artifact<br></blockquote><blockquote type="cite">support. --><br></blockquote><blockquote type="cite"> <metadata:MetadataProvider id="IdPMD"<br></blockquote><blockquote type="cite">xsi:type="metadata:ResourceBackedMetadataProvider"><br></blockquote><blockquote type="cite"> <metadata:MetadataResource<br></blockquote><blockquote type="cite">xsi:type="resource:FilesystemResource"<br></blockquote><blockquote type="cite">file="/opt/shibboleth-idp/metadata/idp-metadata.xml"/><br></blockquote><blockquote type="cite"> </metadata:MetadataProvider><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!-- Load the SP's metadata. --><br></blockquote><blockquote type="cite"> <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider"<br></blockquote><blockquote type="cite"> xmlns="urn:mace:shibboleth:2.0:metadata" id="SPMETADATA"<br></blockquote><blockquote type="cite"> metadataFile="/opt/shibboleth-idp/metadata/sp-metadata.xml" /><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> </metadata:MetadataProvider><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">And here is the sp-metadata.xml that is referred to from RelyingParty.xml:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <EntityDescriptor entityID="<a href="https://sp.ejeklint.se/shibboleth">https://sp.ejeklint.se/shibboleth</a>"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br></blockquote><blockquote type="cite"> <!-- The TestShib Two SP supports SAML 2.0, SAML 1.1, and Shibboleth<br></blockquote><blockquote type="cite">1.2+. --><br></blockquote><blockquote type="cite"> <SPSSODescriptor<br></blockquote><blockquote type="cite"> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol<br></blockquote><blockquote type="cite">urn:oasis:names:tc:SAML:1.1:protocol"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br></blockquote><blockquote type="cite"> <Extensions xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br></blockquote><blockquote type="cite"> <!-- Extension to permit the SP to receive IdP discovery<br></blockquote><blockquote type="cite">responses. --><br></blockquote><blockquote type="cite"> <idpdisc:DiscoveryResponse<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/Login">https://sp.ejeklint.se/Shibboleth.sso/Login</a>"<br></blockquote><blockquote type="cite"> index="1"<br></blockquote><blockquote type="cite">xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"/><br></blockquote><blockquote type="cite"> <idpdisc:DiscoveryResponse<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/Login">https://sp.ejeklint.se/Shibboleth.sso/Login</a>"<br></blockquote><blockquote type="cite"> index="2"<br></blockquote><blockquote type="cite">xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"/><br></blockquote><blockquote type="cite"> </Extensions><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">[verbose key stuff removed...]<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!-- This tells IdPs that Single Logout is supported and<br></blockquote><blockquote type="cite">where/how to request it. --><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <SingleLogoutService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/SOAP">https://sp.ejeklint.se/Shibboleth.sso/SLO/SOAP</a>"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <SingleLogoutService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/Redirect">https://sp.ejeklint.se/Shibboleth.sso/SLO/Redirect</a>"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <SingleLogoutService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/POST">https://sp.ejeklint.se/Shibboleth.sso/SLO/POST</a>"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <SingleLogoutService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SLO/Artifact</a>"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <!-- This tells IdPs that you only need transient identifiers.<br></blockquote><blockquote type="cite">--><br></blockquote><blockquote type="cite"> <NameIDFormat<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat><br></blockquote><blockquote type="cite"> <NameIDFormat<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br></blockquote><blockquote type="cite"> <!--<br></blockquote><blockquote type="cite">This tells IdPs where and how to push assertions through the browser. Mostly<br></blockquote><blockquote type="cite">the SP will tell the IdP what location to use in its request, but this<br></blockquote><blockquote type="cite">is how the IdP validates the location and also figures out which<br></blockquote><blockquote type="cite">SAML version/binding to use.<br></blockquote><blockquote type="cite">--><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <AssertionConsumerService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST">https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST</a>"<br></blockquote><blockquote type="cite"> index="1" isDefault="true"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <AssertionConsumerService<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST-SimpleSign">https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST-SimpleSign</a>"<br></blockquote><blockquote type="cite"> index="2" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <AssertionConsumerService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SAML2/Artifact</a>"<br></blockquote><blockquote type="cite"> index="3" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <AssertionConsumerService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"<br></blockquote><blockquote type="cite"> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML/POST">https://sp.ejeklint.se/Shibboleth.sso/SAML/POST</a>"<br></blockquote><blockquote type="cite"> index="4" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"> <AssertionConsumerService<br></blockquote><blockquote type="cite"> Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SAML/Artifact</a>"<br></blockquote><blockquote type="cite"> index="5" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!--<br></blockquote><blockquote type="cite"> <AttributeConsumingService index="1"><br></blockquote><blockquote type="cite"> <ServiceName xml:lang="en">secure</ServiceName><br></blockquote><blockquote type="cite"> <ServiceDescription xml:lang="en">An example service that requires a<br></blockquote><blockquote type="cite">human-readable identifier and optional name and e-mail<br></blockquote><blockquote type="cite">address.</ServiceDescription><br></blockquote><blockquote type="cite"> </AttributeConsumingService><br></blockquote><blockquote type="cite"> --><br></blockquote><blockquote type="cite"> </SPSSODescriptor><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <!-- This is just information about the entity in human terms. --><br></blockquote><blockquote type="cite"> <Organization xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br></blockquote><blockquote type="cite"> <OrganizationName xml:lang="en"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Shibboleth SP at<br></blockquote><blockquote type="cite"><a href="http://ejeklint.se">ejeklint.se</a></OrganizationName><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <OrganizationDisplayName xml:lang="en"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">EE SP</OrganizationDisplayName><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <OrganizationURL xml:lang="en"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><a href="http://www.ejeklint.se</OrganizationURL>">http://www.ejeklint.se</OrganizationURL></a><br></blockquote><blockquote type="cite"> </Organization><br></blockquote><blockquote type="cite"> <ContactPerson contactType="technical"<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br></blockquote><blockquote type="cite"> <GivenName<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Per</GivenName><br></blockquote><blockquote type="cite"> <SurName<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Ejeklint</SurName><br></blockquote><blockquote type="cite"> <EmailAddress<br></blockquote><blockquote type="cite">xmlns="urn:oasis:names:tc:SAML:2.0:metadata">mailto:ejeklint@me.com</EmailAddress><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> </ContactPerson><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> </EntityDescriptor><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">As for the configuration of the SP, there is indeed a problem with the<br></blockquote><blockquote type="cite">RequestMapper (I think). The metadata that is available<br></blockquote><blockquote type="cite">from <a href="https://sp.ejeklint.se/Shibboleth.sso/Metadata">https://sp.ejeklint.se/Shibboleth.sso/Metadata</a> does indeed have the<br></blockquote><blockquote type="cite">wrong URLs with <a href="http://www.example.com">www.example.com</a> in them, but as I don't have a metadata<br></blockquote><blockquote type="cite">provider pointing to that URL it should still work. Or am I ignorant about<br></blockquote><blockquote type="cite">something here? This is the RequestMapper in shibboleth2.xml which isn't<br></blockquote><blockquote type="cite">doing what I expect:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> <RequestMapper type="Native"><br></blockquote><blockquote type="cite"> <RequestMap><br></blockquote><blockquote type="cite"> <!--<br></blockquote><blockquote type="cite"> The example requires a session for documents in /secure on the<br></blockquote><blockquote type="cite">containing host with http and<br></blockquote><blockquote type="cite"> https on the default ports. Note that the name and port in the<br></blockquote><blockquote type="cite"><Host> elements MUST match<br></blockquote><blockquote type="cite"> Apache's ServerName and Port directives or the IIS Site name in<br></blockquote><blockquote type="cite">the <ISAPI> element above.<br></blockquote><blockquote type="cite"> --><br></blockquote><blockquote type="cite"> <Host name="<a href="http://sp.ejeklint.se">sp.ejeklint.se</a>"><br></blockquote><blockquote type="cite"> <Path name="secure" authType="shibboleth"<br></blockquote><blockquote type="cite">requireSession="true"/><br></blockquote><blockquote type="cite"> </Host><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> </RequestMap><br></blockquote><blockquote type="cite"> </RequestMapper><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Any ideas?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Per Ejeklint<br></blockquote><blockquote type="cite">Address: Heimore Group AB, Götgatan 78 22th floor, SE-118<br></blockquote><blockquote type="cite">30 Stockholm, Sweden<br></blockquote><blockquote type="cite">Phone: +4670-5090052<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">--<br></blockquote><blockquote type="cite">To unsubscribe from this list send an email to<br></blockquote><blockquote type="cite"><a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote><br><br><br>-- <br>Chad La Joie<br><a href="http://www.itumi.biz">www.itumi.biz</a><br>trusted identities, delivered<br>--<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></blockquote></div><br></div></div></body></html>