<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div dir="ltr" id="yui_3_16_0_1_1426189190698_6196">Howdy folks. I am running 2.3.1 SP on Windows. I have a client who sees the incommon WAYF page intermittently when they send an assertion. Currently, I use one session init for everything and this is it:</div><div dir="ltr" id="yui_3_16_0_1_1426189190698_6182"><br></div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6183"><span class="" style="white-space:pre"> </span> </div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6184"><span class="" style="white-space:pre"> </span><SessionInitiator type="Chaining" Location="/InCommon" isDefault="true" id="InCommon" relayState="cookie"></div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6185"> <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/></div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6186"> <SessionInitiator type="Shib1" acsIndex="2"/></div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6187"><span class="" style="white-space:pre"> </span><SessionInitiator type="WAYF" acsIndex="2" URL="https://wayf.incommonfederation.org/DS/WAYF" /></div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6188"> </SessionInitiator></div><div class="" style="" id="yui_3_16_0_1_1426189190698_6189"><br class="" style=""></div><div class="" style="" id="yui_3_16_0_1_1426189190698_6195"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1426189190698_6190">ALL of my clients use an SP link with the entityID embedded so WAYF is not needed. When a user manages to strip the entityID out of the URL, they land on the WAYF page as expected.</div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1426189190698_6191"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1426189190698_6192">This customer gets to the WAYF page after they send the assertion back to me. What might be wrong in the assertion that would make Shib send them to WAYF like that? The assertion is encrypted and I know the issue is on their side (as do they) - They are looking for some guidance as to where to look...</div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1426189190698_6192"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1426189190698_6192">TIA!</div><div dir="ltr" class="" style="" id="yui_3_16_0_1_1426189190698_6193"><br class="" style=""></div></div></body></html>