<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> <!-- The RequestMap defines portions of the webspace to protect --></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> <RequestMapper type="Native"></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> <RequestMap applicationId="default"></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> <Host name="shib.lynda.com"></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> <Path name="InCommon" authType="shibboleth" requireSession="true"/></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> </Host></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> </RequestMap></div><div id="yui_3_16_0_1_1426193574604_3414"></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""> </RequestMapper></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style=""><br></div><div id="yui_3_16_0_1_1426193574604_3414" class="" style="" dir="ltr">That's what I have set so yes - sessions are required...</div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Thursday, March 12, 2015 1:27 PM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On 3/12/15, 4:25 PM, "Cantor, Scott" <<a shape="rect" ymailto="mailto:cantor.2@osu.edu" href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br clear="none">><br clear="none">>But that only happens when there's a protected resource involved, and your trace in the second email doesn't seem to show that.<br clear="none"><br clear="none">Maybe that tunnel reference is connected in some way to the server not recognizing the request to the SAML /POST endpoint as being a handler submission and it's somehow treating that request as a protected resource.<br clear="none"><br clear="none">Either way, do you have requireSession on anywhere in the RequestMap? If not, that's a pretty confusing result.<div class="yqt8532400130" id="yqtfd27243"><br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>