<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">>I guess maybe some oddness with the XML from Okta could be involved. That can be subtle. Can you post the entire Response?<br></blockquote><div>you betcha! somewhat sanitized, but full response </div><div><br></div><div><div><br></div><div><br></div><div><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"</div><div>                 Destination="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>"</div><div>                 ID="id31009012803127171573256615"</div><div>                 InResponseTo="_82f54b67d5db3a8a27d37ce4c86ab246"</div><div>                 IssueInstant="2015-08-13T17:47:13.156Z"</div><div>                 Version="2.0"</div><div>                 xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div>                 ></div><div>    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div>                  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"</div><div>                  ><a href="http://www.okta.com/oktaid123454">http://www.okta.com/oktaid123454</a></saml2:Issuer></div><div>    <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div>        <ds:SignedInfo></div><div>            <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div>            <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>" /></div><div>            <ds:Reference URI="#id31009012803127171573256615"></div><div>                <ds:Transforms></div><div>                    <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></div><div>                    <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div>                        <ec:InclusiveNamespaces xmlns:ec="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</div><div>                                                PrefixList="xs"</div><div>                                                /></div><div>                    </ds:Transform></div><div>                </ds:Transforms></div><div>                <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>" /></div><div>                <ds:DigestValue>CNfvV04BeIx6gHgo0eQN8eGGfn6XZrOdCiHGQ/5Pdnc=</ds:DigestValue></div><div>            </ds:Reference></div><div>        </ds:SignedInfo></div><div>        <ds:SignatureValue>IjQ8o4jqWfm2V5QH1dqhb42HdAcxF+Srbb+EQyiUDuzvkMMaJ3NyAhuzttqlF57piclfUgyD2CCjWM+LWRZ6WOjNNbc1j8YlBPyxAGH/1AqW5QlMptif6dtZtOPWXkMDZk/LidEq2bnxj9aJc6xFcwPH4NWjCpHh5y01roZVM2EB7+jj5bcLakmfhMXHuB8MVIMclp2M1HNcDvm94++2OvOJE7GFWnQ/sEpoHDgo5tc3uLxHZKrTdDHTcuYi+NGcVj5SvI3fCCnZ8SugdoJ1F8Vj8LY7GA9TxaqIIKfcM+bqbvULISkjQ8lTyETxhANboSUGTJQ1CQpKC6ITjU5VbA==</ds:SignatureValue></div><div>        <ds:KeyInfo></div><div>            <ds:X509Data></div><div>                <ds:X509Certificate>MIIDnjCCAoagAwIBAgIGAUvcNiL8MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG</div><div>A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU</div><div>MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2dvZGFkZHkxHDAaBgkqhkiG9w0BCQEWDWlu</div><div>Zm9Ab2t0YS5jb20wHhcNMTUwMzAyMjAzNzMwWhcNNDUwMzAyMjAzODMwWjCBjzELMAkGA1UEBhMC</div><div>VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM</div><div>BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdnb2RhZGR5MRwwGgYJKoZIhvcN</div><div>AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnZaAyoAQ</div><div>2i2quLuvQZ1qRifw0yr3tlC7JMPqX1flkHKEfchk8rpjKNQSftmSPQKRf6NYQbJqiwh/s1vA3j1P</div><div>11/GAyXW9Yt3h2+U2zIWFJi2J7p1I9jIlGNpEw4i5lCT1NVFZ2/roT5Lj0CJnYmD2Ob78o5/2iyp</div><div>I0q+EuYvK2+op+VIXNaprKUQvOfg/dNVv/pHIgkZrXkAf7yCfEdP6qRn5GPgg/lhidFF7Nhm1969</div><div>JVVXwWoqfHL8XnSB9qsSaFNLCWEBENmX6wIX6aP5+6OPBgYO659nvFnxdvqhMFRTwfOukNDXhsiX</div><div>4munrETtDozBVSqKCyua7Pel7qRTNQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBeyfvsbGLg5T4y</div><div>55/0LpvYq+4h4x1RPRmX/xsEIRZV5tDSK2UB7GgAi3xkmNRr2yLcawDKTCCRqosDK9j2gzVHiEtp</div><div>qMY1dSPJKdGX5qAYXif/eAYpQcoXNuhi0EWFHtXlAkONVgXd0dc8z88Yb000zFz3uJOr4X+Dyg1c</div><div>Zmx+0qqYvZuEzGH2kdt1EL+hVMTojmF1IfytPReh+ZZjgrtUGLK6s7UaFDHHAvYPLDi8xUY58Y1M</div><div>sVd14ZKv1cLCQCfE57Ccr/dEL7gqclJvTQErK9G2LhjE5s0zGlAl+h/irLfB6FdnvRj1Pn1xmnTm</div><div>BlpuVx+w9fkkzCKDqfT91qUB</ds:X509Certificate></div><div>            </ds:X509Data></div><div>        </ds:KeyInfo></div><div>    </ds:Signature></div><div>    <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"></div><div>        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></div><div>    </saml2p:Status></div><div>    <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div>                     ID="id31009012804284251001162800"</div><div>                     IssueInstant="2015-08-13T17:47:13.156Z"</div><div>                     Version="2.0"</div><div>                     xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div>                     ></div><div>        <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"</div><div>                      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div>                      ><a href="http://www.okta.com/oktaid123454">http://www.okta.com/oktaid123454</a></saml2:Issuer></div><div>        <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div>            <ds:SignedInfo></div><div>                <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div>                <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>" /></div><div>                <ds:Reference URI="#id31009012804284251001162800"></div><div>                    <ds:Transforms></div><div>                        <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></div><div>                        <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div>                            <ec:InclusiveNamespaces xmlns:ec="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</div><div>                                                    PrefixList="xs"</div><div>                                                    /></div><div>                        </ds:Transform></div><div>                    </ds:Transforms></div><div>                    <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>" /></div><div>                    <ds:DigestValue>V91b0StZzdNKByp1r7XbVtAmPhtRMoMZgEkX8Z0K4xE=</ds:DigestValue></div><div>                </ds:Reference></div><div>            </ds:SignedInfo></div><div>            <ds:SignatureValue>WmlUBVTWAzOZMnIdJe8P+IzRoGjSJX0ICb3glnIotDk8zbZQDrCyJDdoxUMWLNHiojdwZqEoi33g9xq1BTbnxJgzC35eC7U9kktrhVmDd1eM+hWA+uAzXAHOfXRfbQxyz4XIpiMccN6CmjdtC5JKrevBuIRHyKLjt26gSJxA7WqK+2uH7T2MqgIPwhY+FDpy2yYcxzWqg7/JbeI3PGRQrhDzLElaELwD0kkuNuJBT9Jh4yVq8Cah7V5dNd2mY3L/AwstVtjgsVeHeeMBbe0XFnrY6frnVBCdSoHv5h4yXbtDxxaHS7GR4zfuYVbhDAYCxwoaYAWNd2HIxUYKsfbeFQ==</ds:SignatureValue></div><div>            <ds:KeyInfo></div><div>                <ds:X509Data></div><div>                    <ds:X509Certificate>MIIDnjCCAoagAwIBAgIGAUvcNiL8MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG</div><div>A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU</div><div>MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2dvZGFkZHkxHDAaBgkqhkiG9w0BCQEWDWlu</div><div>Zm9Ab2t0YS5jb20wHhcNMTUwMzAyMjAzNzMwWhcNNDUwMzAyMjAzODMwWjCBjzELMAkGA1UEBhMC</div><div>VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM</div><div>BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdnb2RhZGR5MRwwGgYJKoZIhvcN</div><div>AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnZaAyoAQ</div><div>2i2quLuvQZ1qRifw0yr3tlC7JMPqX1flkHKEfchk8rpjKNQSftmSPQKRf6NYQbJqiwh/s1vA3j1P</div><div>11/GAyXW9Yt3h2+U2zIWFJi2J7p1I9jIlGNpEw4i5lCT1NVFZ2/roT5Lj0CJnYmD2Ob78o5/2iyp</div><div>I0q+EuYvK2+op+VIXNaprKUQvOfg/dNVv/pHIgkZrXkAf7yCfEdP6qRn5GPgg/lhidFF7Nhm1969</div><div>JVVXwWoqfHL8XnSB9qsSaFNLCWEBENmX6wIX6aP5+6OPBgYO659nvFnxdvqhMFRTwfOukNDXhsiX</div><div>4munrETtDozBVSqKCyua7Pel7qRTNQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBeyfvsbGLg5T4y</div><div>55/0LpvYq+4h4x1RPRmX/xsEIRZV5tDSK2UB7GgAi3xkmNRr2yLcawDKTCCRqosDK9j2gzVHiEtp</div><div>qMY1dSPJKdGX5qAYXif/eAYpQcoXNuhi0EWFHtXlAkONVgXd0dc8z88Yb000zFz3uJOr4X+Dyg1c</div><div>Zmx+0qqYvZuEzGH2kdt1EL+hVMTojmF1IfytPReh+ZZjgrtUGLK6s7UaFDHHAvYPLDi8xUY58Y1M</div><div>sVd14ZKv1cLCQCfE57Ccr/dEL7gqclJvTQErK9G2LhjE5s0zGlAl+h/irLfB6FdnvRj1Pn1xmnTm</div><div>BlpuVx+w9fkkzCKDqfT91qUB</ds:X509Certificate></div><div>                </ds:X509Data></div><div>            </ds:KeyInfo></div><div>        </ds:Signature></div><div>        <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></div><div>            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"><a href="mailto:sgerlach@company.com">sgerlach@company.com</a></saml2:NameID></div><div>            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div>                <saml2:SubjectConfirmationData InResponseTo="_82f54b67d5db3a8a27d37ce4c86ab246"</div><div>                                               NotOnOrAfter="2015-08-13T17:52:13.156Z"</div><div>                                               Recipient="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>"</div><div>                                               /></div><div>            </saml2:SubjectConfirmation></div><div>        </saml2:Subject></div><div>        <saml2:Conditions NotBefore="2015-08-13T17:42:13.156Z"</div><div>                          NotOnOrAfter="2015-08-13T17:52:13.156Z"</div><div>                          xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div>                          ></div><div>            <saml2:AudienceRestriction></div><div>                <saml2:Audience><a href="https://myserver.com">https://myserver.com</a></saml2:Audience></div><div>            </saml2:AudienceRestriction></div><div>        </saml2:Conditions></div><div>        <saml2:AuthnStatement AuthnInstant="2015-08-13T17:47:13.156Z"</div><div>                              SessionIndex="_82f54b67d5db3a8a27d37ce4c86ab246"</div><div>                              xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div>                              ></div><div>            <saml2:AuthnContext></div><div>                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div>            </saml2:AuthnContext></div><div>        </saml2:AuthnStatement></div><div>        <saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></div><div>            <saml2:Attribute Name="firstName"</div><div>                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"</div><div>                             ></div><div>                <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div>                                      xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div>                                      xsi:type="xs:string"</div><div>                                      >Scott</saml2:AttributeValue></div><div>            </saml2:Attribute></div><div>            <saml2:Attribute Name="lastname"</div><div>                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"</div><div>                             ></div><div>                <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div>                                      xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div>                                      xsi:type="xs:string"</div><div>                                      >Gerlach</saml2:AttributeValue></div><div>            </saml2:Attribute></div><div>        </saml2:AttributeStatement></div><div>    </saml2:Assertion></div><div></saml2p:Response></div><div><br></div></div></div></div></div>