<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">After many months of stumbling attempting to use our Shibboleth IdP for authentication to DocuSign, we’re seeing systematic failure to process the SAML assertion from our IdP ("The SAMLResponse structure did not contain expected nodes or was incorrectly formatted - No assertions in response”). Following examination of the SAML response from logs, DocuSign is telling me:<div><span style="font-family: 'Times New Roman', serif; font-size: 10pt; color: rgb(31, 73, 125);"><br></span></div><div><blockquote type="cite">[1]<span style="font-family: 'Times New Roman', serif; font-size: 10pt; color: rgb(31, 73, 125);"> </span><span style="font-family: 'Times New Roman', serif; font-size: 12pt; color: rgb(31, 73, 125);">There are ... 2 values passed [in cn or commonName] – there should only be 1 value and it should be the one that matches exactly what’s set in DocuSign</span><font color="#1f497d" face="Times New Roman, serif" size="3">…</font></blockquote><div><br></div><div><div><br></div><div><blockquote type="cite"><span style="color: rgb(31, 73, 125); font-family: 'Times New Roman', serif; font-size: 16px;">[2] keep it simple, swap out the urn:oid and put the friendly name in its place, that should help</span></blockquote><br></div><div>Setting aside the perverseness and glibness, is [2] even possible?</div><div><br></div><div>Can I release a SAML attribute without a Name, only a friendlyName?</div><div><br></div><div>Perhaps I am supposed to put their version of friendlyName into the Name? </div></div></div><div><br></div><div>David Bantz</div><div>U Alaska IAM</div></body></html>