<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><blockquote type="cite"><div><div dir="ltr"><div>But still i am not clear how to get the Principal at SP side without dataconnector.</div></div></div></blockquote><div><br></div><div>The same way you get any other attribute. Encode it suitably and arrange for your filters to release it to that SP. If needs be configure the SP to make the attribute to the Application.</div><br><blockquote type="cite"><div><div dir="ltr"><div>What this means from the docs '<span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px;background-color:rgb(255,253,246)">The principal name comes exclusively from internal IdP state.</span>'?</div></div><div class="gmail_extra"></div></div></blockquote><br><div><font color="#5856d6">That is just an indication that the principal might not be in the format that you expected. For instances after logging in against active directory you might expect the principal to be 'EXAMPLE/USER' but it might be '<a href="mailto:user@example.com">user@example.com</a>' or just 'user'. It will all depend on what the login handler has converted whatever the user entered. For any given handler this conversion will always be consistent, but you may need to add some conversion into the mix.</font></div></body></html>