<div dir="ltr"><div>Thanks for the info Scott!</div><div><br></div><div>>Trace the SAML and see what it's putting in there.</div><div><br>So I removed the trailing slash and traced the SAML and get the same error, but here is the SAML that's being posted back to the Shibboleth endpoint</div><div><pre id="txt"> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData InResponseTo="_82f54b67d5db3a8a27d37ce4c86ab246"
                                               NotOnOrAfter="2015-08-13T17:52:13.156Z"
                                               Recipient="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2015-08-13T17:42:13.156Z"
                          NotOnOrAfter="2015-08-13T17:52:13.156Z"
                          xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                          >
            <saml2:AudienceRestriction>
                <saml2:Audience><a href="https://myserver.com">https://myserver.com</a></saml2:Audience>
            </saml2:AudienceRestriction></pre><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="HOEnZb"><font color="#888888"><br>
</font></span></blockquote></div><br></div></div></div>