<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.StileMessaggioDiPostaElettronica17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.CodeChar
{mso-style-name:"Code Char";
mso-style-link:Code;
font-family:"Courier New";
color:black;
background:#E5E5CC;}
p.Code, li.Code, div.Code
{mso-style-name:Code;
mso-style-link:"Code Char";
margin:0cm;
margin-bottom:.0001pt;
background:#E5E5CC;
border:none;
padding:0cm;
font-size:8.0pt;
font-family:"Courier New";
color:black;
mso-fareast-language:EN-US;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I federated my Shibboleth 2.3.8 with Office 365 following the guide on
<a href="http://www.microsoft.com/en-us/download/details.aspx?id=35464">http://www.microsoft.com/en-us/download/details.aspx?id=35464</a>.<o:p></o:p></p>
<p class="MsoNormal">Now I need some help to identify what I should check to make sure that the same assertions are sent to WEB clients and ACTIVE clients, because right now only the WEB clients work.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In fact, WEB clients generate the 2 pieces of information (<span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">NameID</span> and
<span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">IDPEmail</span>) that should be received by the relying party (Office 365), tracked in idp-process.log:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:dashed windowtext 1.0pt;padding:1.0pt 4.0pt 1.0pt 4.0pt;background:white">
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> SPNameQualifier="urn:federation:MicrosoftOnline"><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> WcwzuD50xEmCH3xsfbbeEA== (THIS IS
<a href="mailto:michelle@shibbdomain.eduteamit.net">michelle@shibbdomain.eduteamit.net</a></span><span style="font-size:9.0pt;font-family:"Lucida Console";color:windowtext">’s</span><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> OBJECT
GUID)<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"></saml2:NameID><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:14.0pt"><o:p> </o:p></span></p>
<div style="mso-element:para-border-div;border:dashed windowtext 1.0pt;padding:0cm 4.0pt 1.0pt 4.0pt;background:white">
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"><saml2:Attribute FriendlyName="UserId"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> Name="IDPEmail"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> <saml2:AttributeValue xmlns:xsi="https://shibbidp.eduteamit.net/idp/shibboleth"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> xsi:type="xs:string"><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">michelle@shibbdomain.eduteamit.net<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> </saml2:AttributeValue><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"></saml2:Attribute><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"><o:p> </o:p></span></p>
<p class="Code" style="background:#E5E5CC;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">23:07:44.653 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">23:07:44.653 - INFO [Shibboleth-Audit:989] - 20130114T220744Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8b617a4a01b92a7d9830d18418d81a37|michela@shibbdomain.eduteamit.net|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|WcwzuD50xEmCH3xsfbbeEA==|_3ef09127e94722c764188b957d125394,|<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I use and ACTIVE client, instead, I receive a different token tracked in idp-process.log:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:dashed windowtext 1.0pt;padding:1.0pt 4.0pt 1.0pt 4.0pt;background:white">
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth"
<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> SPNameQualifier="urn:federation:MicrosoftOnline"><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"> _3ee899df0e468beed1e88f9d7e47a1c9 (WHERE IS THIS STRING COMING FROM? THE USER IS THE SAME
<a href="mailto:michelle@shibbdomain.eduteamit.net">michelle@shibbdomain.eduteamit.net</a>)<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"></saml2:NameID><o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634"><o:p> </o:p></span></p>
<p class="Code" style="background:#E5E5CC;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">23:09:32.303 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.<o:p></o:p></span></p>
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">23:09:32.303 - INFO [Shibboleth-Audit:989] - 20130114T220932Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_7420ec54-1dfb-454f-a32c-547723139e89|urn:federation:MicrosoftOnline|urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_b72b11fb59453efbca8ff389f23d6c19|michela||transientId,eduPersonScopedAffiliation,|_3ee899df0e468beed1e88f9d7e47a1c9|_3462d0090ac26e82b1b681060216bc33,|<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:14.0pt"><o:p> </o:p></span></p>
<div style="mso-element:para-border-div;border:dashed windowtext 1.0pt;padding:0cm 4.0pt 1.0pt 4.0pt;background:white">
<p class="Code" style="background:white;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Lucida Console";color:#943634">MISSING USERID<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As a matter of facts, when I run the Outlook wizard to configure the user (with IMAP or ActiveSync which are Active clients), it keeps asking the user password over and over.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I used Office365 metadata that are published on <a href="https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml">
https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml</a>, which should contain passive endpoint for WEB clients + active endpoint for rich e-mail client clients like Outlook:<o:p></o:p></p>
<p class="MsoNormal"> <AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/login.srf"/><o:p></o:p></p>
<p class="MsoNormal"> <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://login.microsoftonline.com/login.srf"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Furthremore, as requested in the guide, I added the following part to web.xml<o:p></o:p></p>
<p class="MsoNormal"> <security-constraint> <o:p></o:p></p>
<p class="MsoNormal"> <display-name>Shibboleth IdP</display-name>
<o:p></o:p></p>
<p class="MsoNormal"> <web-resource-collection> <o:p>
</o:p></p>
<p class="MsoNormal"> <web-resource-name>ECP</web-resource-name>
<o:p></o:p></p>
<p class="MsoNormal"> <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
<o:p></o:p></p>
<p class="MsoNormal"> <http-method>GET</http-method>
<o:p></o:p></p>
<p class="MsoNormal"> <http-method>POST</http-method>
<o:p></o:p></p>
<p class="MsoNormal"> </web-resource-collection> <o:p></o:p></p>
<p class="MsoNormal"> <auth-constraint> <o:p></o:p></p>
<p class="MsoNormal"> <role-name>*</role-name><o:p></o:p></p>
<p class="MsoNormal"> </auth-constraint> <o:p></o:p></p>
<p class="MsoNormal"> <user-data-constraint> <o:p></o:p></p>
<p class="MsoNormal"> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
<o:p></o:p></p>
<p class="MsoNormal"> </user-data-constraint> <o:p></o:p></p>
<p class="MsoNormal"> </security-constraint><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <login-config><o:p></o:p></p>
<p class="MsoNormal"> <auth-method>BASIC</auth-method><o:p></o:p></p>
<p class="MsoNormal"> <realm-name>ShibUserPassAuth</realm-name><o:p></o:p></p>
<p class="MsoNormal"> </login-config><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Full assertions follow. I have no errors reported in the idp-process.log file, which lists 3500 lines for a single ECP or WEB call.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mauro<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">THIS WORKS (WITH WEB CLIENT):<o:p></o:p></p>
<p class="MsoNormal">===============================================================<o:p></o:p></p>
<p class="MsoNormal"> <saml2:Subject><o:p></o:p></p>
<p class="MsoNormal"> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">WcwzuD50xEmCH3xsfbbeEA==</saml2:NameID><o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectConfirmationData Address="87.24.1.141" InResponseTo="_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63" NotOnOrAfter="2013-01-14T22:12:44.481Z" Recipient="https://login.microsoftonline.com/login.srf"/><o:p></o:p></p>
<p class="MsoNormal"> </saml2:SubjectConfirmation><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Subject><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Conditions NotBefore="2013-01-14T22:07:44.481Z" NotOnOrAfter="2013-01-14T22:12:44.481Z"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AudienceRestriction><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Audience>urn:federation:MicrosoftOnline</saml2:Audience><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AudienceRestriction><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Conditions><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnStatement AuthnInstant="2013-01-14T22:07:44.356Z" SessionIndex="7e5d09aac0cc5cdf6a4872cb4a0ee5494eb689449e3cb2f560fcfd7aad52a999"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectLocality Address="87.24.1.141"/><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnContext><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AuthnContext><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AuthnStatement><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeStatement><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member@shibbdomain.eduteamit.net</saml2:AttributeValue><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Attribute><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Attribute FriendlyName="UserId" Name="IDPEmail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">michela@shibbdomain.eduteamit.net</saml2:AttributeValue><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Attribute><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeValue><o:p></o:p></p>
<p class="MsoNormal"> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">rNIjb0eGUF9akyrG0BsHOoIZE6g=</saml2:NameID><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AttributeValue><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Attribute><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AttributeStatement><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Assertion><o:p></o:p></p>
<p class="MsoNormal"></saml2p:Response><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">23:07:44.653 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.<o:p></o:p></p>
<p class="MsoNormal">23:07:44.653 - INFO [Shibboleth-Audit:989] - 20130114T220744Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8b617a4a01b92a7d9830d18418d81a37|michela@shibbdomain.eduteamit.net|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|WcwzuD50xEmCH3xsfbbeEA==|_3ef09127e94722c764188b957d125394,|<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">THIS DOES NOT WORK (WITH ACTIVE CLIENT OUTLOOK):<o:p></o:p></p>
<p class="MsoNormal">===============================================================<o:p></o:p></p>
<p class="MsoNormal"> <saml2:Subject><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Subject><o:p></o:p></p>
<p class="MsoNormal"> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth">_3ee899df0e468beed1e88f9d7e47a1c9</saml2:NameID><o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> 59CC33B83E74C449821F7C6C7DB6DE10<o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectConfirmationData Address="157.56.252.21" InResponseTo="_7420ec54-1dfb-454f-a32c-547723139e89" NotOnOrAfter="2013-01-14T22:14:32.225Z" Recipient="https://login.microsoftonline.com/login.srf"/><o:p></o:p></p>
<p class="MsoNormal"> </saml2:SubjectConfirmation><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Subject><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Conditions NotBefore="2013-01-14T22:09:32.225Z" NotOnOrAfter="2013-01-14T22:14:32.225Z"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AudienceRestriction><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Audience>urn:federation:MicrosoftOnline</saml2:Audience><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AudienceRestriction><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Conditions><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnStatement AuthnInstant="2013-01-14T22:09:32.225Z"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:SubjectLocality Address="157.56.252.21"/><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnContext><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AuthnContext><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AuthnStatement><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeStatement><o:p></o:p></p>
<p class="MsoNormal"> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><o:p></o:p></p>
<p class="MsoNormal"> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member@shibbdomain.eduteamit.net</saml2:AttributeValue><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Attribute><o:p></o:p></p>
<p class="MsoNormal"> </saml2:AttributeStatement><o:p></o:p></p>
<p class="MsoNormal"> </saml2:Assertion><o:p></o:p></p>
<p class="MsoNormal"> </saml2p:Response><o:p></o:p></p>
<p class="MsoNormal"> </soap11:Body><o:p></o:p></p>
<p class="MsoNormal"></soap11:Envelope><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">23:09:32.303 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.<o:p></o:p></p>
<p class="MsoNormal">23:09:32.303 - INFO [Shibboleth-Audit:989] - 20130114T220932Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_7420ec54-1dfb-454f-a32c-547723139e89|urn:federation:MicrosoftOnline|urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_b72b11fb59453efbca8ff389f23d6c19|michela||transientId,eduPersonScopedAffiliation,|_3ee899df0e468beed1e88f9d7e47a1c9|_3462d0090ac26e82b1b681060216bc33,|<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you very much for any suggestions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mauro <o:p></o:p></p>
</div>
</body>
</html>