<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><span id="yui_3_16_0_1_1426191182965_3275">In a fiddler trace I see them sending the assertion here on a successful attempt:</span></div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><table class="" style="" id="yui_3_16_0_1_1426191182965_3790"><tbody class="" style="" id="yui_3_16_0_1_1426191182965_3789"><tr class="" style=""><th class="" style="">#</th><th class="" style="">Result</th><th class="" style="">Protocol</th><th class="" style="">Host</th><th class="" style="">URL</th><th class="" style="">Body</th><th class="" style="">Caching</th><th class="" style="">Content-Type</th><th class="" style="">Process</th><th class="" style="">Comments</th><th class="" style="">Custom</th></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_3788"><td class="" style="">6</td><td class="" style="">302</td><td class="" style="">HTTPS</td><td class="" style="">shib.lynda.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_3787">/Shibboleth.sso/InCommon?providerId=http://annalectu.com&target=https://shib.lynda.com/InCommon</td><td class="" style="">40</td><td class="" style="">private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT</td><td class="" style="">text/html</td><td class="" style="">iexplore:2476</td><td class="" style="">[#6]</td><td class="" style=""></td></tr><tr class="" style=""><td class="" style="">7</td><td class="" style="">200</td><td class="" style="">HTTP</td><td class="" style="">annalectu.com</td><td class="" style="">/applications/annalect/default.aspx?SAMLRequest=fZJfT4MwFMW%2FCuk7fwfomkGC24NLpi4DffDFlHInJKXF3qLbt5eBLvPBJX1p%0A7jnn9vzSBbJWdDTrTS138NEDGuvQCol0HCSk15Iqhg1SyVpAajjNs4cNDRyP%0AdloZxZUgVoYI2jRKLpXEvgWdg%2F5sODzvNgmpjemQui7WTemIo6yYw1Xr5sO1%0AVAJM7SAq95QauNunvCDWanhGI9kpcLIPbiYlE8BNP5pZ14mGjwo8j9wK9qwX%0AxmHYHYi1XiXkLY7BK%2BMIeBjNIeRhWbEq4t4%2BmN3EceWHgwyxh7VEw6RJSOD5%0Ake3NbD8o%2FDkdjnf7SqztT9O7RlaNfL%2BOpZxESO%2BLYmtPjV5A49hmEJB0cYJL%0Ax8X6Avf1WPbLmKT%2FEMUzURu7hXuxZNrY0cchdb3aqoHd0cqEUF9LDcxAQnzi%0AppPl729IvwE%3D%0A&RelayState=cookie%3Aa9249f5d</td><td class="" style="">4,979</td><td class="" style="">private</td><td class="" style="">text/html; charset=utf-8</td><td class="" style="">iexplore:2476</td><td class="" style="">[#7]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_3792"><td class="" style="" id="yui_3_16_0_1_1426191182965_3791">8</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4523">302</td><td class="" style="">HTTPS</td><td class="" style="">shib.lynda.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4727">/Shibboleth.sso/SAML2/POST</td><td class="" style="">40</td><td class="" style="">private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT</td><td class="" style="">text/html</td><td class="" style="">iexplore:2476</td><td class="" style="">[#8]</td><td class="" style=""></td></tr></tbody></table><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr">A failed attempt looks like this:</div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><table class="" style="" id="yui_3_16_0_1_1426191182965_4313"><tbody class="" style="" id="yui_3_16_0_1_1426191182965_4312"><tr class="" style="" id="yui_3_16_0_1_1426191182965_4729"><th class="" style="">#</th><th class="" style="">Result</th><th class="" style="">Protocol</th><th class="" style="">Host</th><th class="" style="" id="yui_3_16_0_1_1426191182965_4728">URL</th><th class="" style="">Body</th><th class="" style="">Caching</th><th class="" style="">Content-Type</th><th class="" style="">Process</th><th class="" style="">Comments</th><th class="" style="">Custom</th></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4498"><td class="" style="">6</td><td class="" style="">302</td><td class="" style="">HTTPS</td><td class="" style="">shib.lynda.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4497">/Shibboleth.sso/InCommon?providerId=http://annalectu.com&target=https://shib.lynda.com/InCommon</td><td class="" style="">40</td><td class="" style="">private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT</td><td class="" style="">text/html</td><td class="" style="">iexplore:2476</td><td class="" style="">[#6]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4502"><td class="" style="">7</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4503">200</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4501">HTTP</td><td class="" style="">annalectu.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4730">/applications/annalect/default.aspx?SAMLRequest=fZJfT4MwFMW%2FCuk7fwfomkGC24NLpi4DffDFlHInJKXF3qLbt5eBLvPBJX1p%0A7jnn9vzSBbJWdDTrTS138NEDGuvQCol0HCSk15Iqhg1SyVpAajjNs4cNDRyP%0AdloZxZUgVoYI2jRKLpXEvgWdg%2F5sODzvNgmpjemQui7WTemIo6yYw1Xr5sO1%0AVAJM7SAq95QauNunvCDWanhGI9kpcLIPbiYlE8BNP5pZ14mGjwo8j9wK9qwX%0AxmHYHYi1XiXkLY7BK%2BMIeBjNIeRhWbEq4t4%2BmN3EceWHgwyxh7VEw6RJSOD5%0Ake3NbD8o%2FDkdjnf7SqztT9O7RlaNfL%2BOpZxESO%2BLYmtPjV5A49hmEJB0cYJL%0Ax8X6Avf1WPbLmKT%2FEMUzURu7hXuxZNrY0cchdb3aqoHd0cqEUF9LDcxAQnzi%0AppPl729IvwE%3D%0A&RelayState=cookie%3Aa9249f5d</td><td class="" style="">4,979</td><td class="" style="">private</td><td class="" style="">text/html; charset=utf-8</td><td class="" style="">iexplore:2476</td><td class="" style="">[#7]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4496"><td class="" style="">8</td><td class="" style="">302</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4500">HTTPS</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4499">shib.lynda.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4495">/Shibboleth.sso/SAML2/POST</td><td class="" style="">40</td><td class="" style="">private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT</td><td class="" style="">text/html</td><td class="" style="">iexplore:2476</td><td class="" style="">[#8]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4494"><td class="" style="">9</td><td class="" style="">200</td><td class="" style="">HTTP</td><td class="" style="">Tunnel to</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4493">t.urs.microsoft.com:443</td><td class="" style="">686</td><td class="" style=""></td><td class="" style=""></td><td class="" style="">iexplore:2476</td><td class="" style="">[#9]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4490"><td class="" style="">10</td><td class="" style="">302</td><td class="" style="">HTTPS</td><td class="" style="">shib.lynda.com</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4489">/InCommon</td><td class="" style="">40</td><td class="" style="">private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT</td><td class="" style="">text/html</td><td class="" style="">iexplore:2476</td><td class="" style="">[#10]</td><td class="" style=""></td></tr><tr class="" style="" id="yui_3_16_0_1_1426191182965_4311"><td class="" style="">11</td><td class="" style="">200</td><td class="" style="">HTTP</td><td class="" style="">Tunnel to</td><td class="" style="" id="yui_3_16_0_1_1426191182965_4310">wayf.incommonfederation.org:443</td><td class="" style="">736</td><td class="" style=""></td><td class="" style=""></td><td class="" style="">iexplore:2476</td><td class="" style="">[#11]</td><td class="" style=""></td></tr></tbody></table><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr">Everything up to step 9 in this last one matches the successful one - No idea what that tunnel to that MS address is...</div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><div id="yui_3_16_0_1_1426191182965_3099" dir="ltr"><br></div><div id="yui_3_16_0_1_1426191182965_3539"><br></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Thursday, March 12, 2015 12:55 PM, Peter Schober <peter.schober@univie.ac.at> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">* Mike Flynn <<a shape="rect" ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> [2015-03-12 20:47]:<div class="yqt2409156304" id="yqtfd65381"><br clear="none">> ALL of my clients use an SP link with the entityID embedded so WAYF<br clear="none">> is not needed. When a user manages to strip the entityID out of the<br clear="none">> URL, they land on the WAYF page as expected.<br clear="none">> This customer gets to the WAYF page after they send the assertion<br clear="none">> back to me. What might be wrong in the assertion that would make<br clear="none">> Shib send them to WAYF like that? The assertion is encrypted and I<br clear="none">> know the issue is on their side (as do they) - They are looking for<br clear="none">> some guidance as to where to look...</div><br clear="none"><br clear="none">That sounds to me like the IDP sends the response to some protected<br clear="none">part of your site, instead of to your ACS URLs. You could verify that<br clear="none">(or rule it our) from your webserver's access logs.<br clear="none">-peter<br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br></div> </div> </div> </div> </div></body></html>