2016-11-23 10:55:08,711 - DEBUG [PROTOCOL_MESSAGE:166] - SAML 2 IdP-initiated request was: IdPInitiatedSSORequest{entityId=https://xxxxxxx-ucdavis.kronos.net, acsURL=null, relayState=null, time=2016-11-23T18:55:08.710Z} Synthetically constructed SAML 2 AuthnRequest was: 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest ID="_dbf9a31f-ebe6-454a-a6b1-e65aeeb2b95c"
    IssueInstant="2016-11-23T18:55:08.710Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://xxxxxxx-ucdavis.kronos.net</saml2:
Issuer>
    <saml2p:NameIDPolicy AllowCreate="true"/>
</saml2p:AuthnRequest>

...

2016-11-23 10:55:09,767 - DEBUG [PROTOCOL_MESSAGE:70] - 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="https://xxxxxxx-ucdavis.kronos.net/wfc/logonWithUID"
    ID="_c44132d95926655d0c314a015b29ccd3"
    IssueInstant="2016-11-23T18:55:09.558Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:ucdavis.edu</saml2:Issue
r>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_f6b4f89375cb9475affffb19dc6f4c1e"
        IssueInstant="2016-11-23T18:55:09.558Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion
">
        <saml2:Issuer>urn:mace:incommon:ucdavis.edu</saml2:Issuer>
        <ds:Signature
                    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
                    Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference
                            URI="#_f6b4f89375cb9475affffb19dc6f4c1e">
<ds:Transforms>
<ds:Transform
                            Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform
                        Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>soMK7u5g5KxfBoFgppnTnXLXPS4VP2DvUJeCU1p1Z+Y=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
bQ5IckDBh6QI8qs89Ew9SQUS2zdV2UufoK6UF+ngQzsmH23xucmSUOHYUGCsPikrkI+TN8dXEgrd
YImK1HBZvhYDys9WHzwKM1zBFom7ODC9Gi0lYWthrFNQl12cOJpKj7Jb2cVelwX/gnITfp/sXw6g
z/Jy0HgCQ8PVkbObWVTqEubw6FOMF7nEkJZB9a8c6nzXOug1CRMPzuzP3KqPdxa7PA6Pb7K3ovLV
xURjX/DhIK+DQ8ylSW/nWsxlgs5viOPUc6DuTa3JuaECGHcW48nYu4LYMPaZ9KV2yQpWqxHZv+2S
YQxQ2fjz3s8EMB78sc/L2bedo3z5iFvxj3+Qmw==
</ds:SignatureValue>
<ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIDFTCCAf2gAwIBAgIJAPPcLMuZiVH8MA0GCSqGSIb3DQEBBQUAMCExHzAdBgNVBAMMFnNoaWJi
b2xldGgudWNkYXZpcy5lZHUwHhcNMTMwNDAzMjAxNDE2WhcNMzMwNTAzMjAxNDE2WjAhMR8wHQYD
VQQDDBZzaGliYm9sZXRoLnVjZGF2aXMuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAsp192eOPILgmh31WyOOXSfAeHy26ZLQPynjO011vO2iN9WfpNnkw10jOYc8n++rmTBt+CPrl
d6zPm9vyF0YyhFgA3np8nEnsX94rdc/x4bZaVHDo5V0yUW7dqeZ0QpxMMBDLiJu+i5QyHzGORgrf
A9vbditbtIF2yBKVhtwtuAJ4EMMVXMgDrddh3iwuYDIkizb9ro6wyb+g2BYft/rXYzV1Q5y7PJuu
7/5tobEELnBPUX96NBtN0xHPRk69BmqIOHb0I3subojQd2mJMHAJZBa31rVSqMoqDc1XvzRoNAnb
FGVkoFsDJ7Pub/Bp9TwpY5M4x20xLereaW3XOU3+dQIDAQABo1AwTjAdBgNVHQ4EFgQUgYNUwHp+
5Mcj29XUBc82gYlyAGAwHwYDVR0jBBgwFoAUgYNUwHp+5Mcj29XUBc82gYlyAGAwDAYDVR0TBAUw
AwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjx0V9ar1jRCHJQ/iZQ27oHbIOTW+eM0LDO6j9vESk5a+
4CvpIJ+F+Wjom1eCaM6Hm1o0ZLcODJRQpJVuWEItoe3vaa3flN5L7KX7txP7/BQrfm6SY+RM4HtV
AidvTfycM5nTxWpy84E19u2VU4THdwAWEBGcJUNxlNrgT9ELZpOorx5+g2v7wNQMjfSwPtyOLPTF
/1jGkQcTao1ZdejLuVbwTykBVFPeFQ8kAU6wsQpXeG3atpQlzxm9ugFEeQnBFLCckELT9sAV/5yz
XtAdSexhyi4+wJ4peM57Kncf/SfdKeMKiyWtEyhVP7yaI/7vtaqct2bie69yO4PiaRMyaQ==</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject>
            <saml2:NameID Format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                NameQualifier="urn:mace:incommon:ucdavis.edu"
                SPNameQualifier="https://xxxxxxx-ucdavis.kronos.net" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">XXXXXXX@ucdavis.edu</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="169.237.xx.xx"
                    NotOnOrAfter="2016-11-23T19:00:09.601Z" Recipient="https://xxxxxxx-ucdavis.kronos.net/wfc/logonWithUID"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2016-11-23T18:55:09.558Z" NotOnOrAfter="2016-11-23T19:00:09.558Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>https://xxxxxxx-ucdavis.kronos.net</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2016-11-23T18:55:08.973Z" SessionIndex="_764c798ea20726332f55b915e4078bd2">
            <saml2:SubjectLocality Address="169.237.xx.xx"/>
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

======================================================================

2016-11-23 10:55:18,202 - DEBUG [PROTOCOL_MESSAGE:166] - SAML 2 IdP-initiated request was: IdPInitiatedSSORequest{entityId=https://xxxxxxx-ucdavis.kronos.net, acsURL=null, relayState=null, time=2016-11-23T18:55:18.201Z} Synthetically constructed SAML 2 AuthnRequest was: 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest ID="_c4726c02-5328-4ddb-a65c-a987bc5d129d"
    IssueInstant="2016-11-23T18:55:18.201Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://xxxxxxx-ucdavis.kronos.net</saml2:
Issuer>
    <saml2p:NameIDPolicy AllowCreate="true"/>
</saml2p:AuthnRequest>

...

2016-11-23 10:55:18,789 - DEBUG [PROTOCOL_MESSAGE:70] - 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="https://xxxxxxx-ucdavis.kronos.net/wfc/logonWithUID"
    ID="_cd3e7071d70b9522f6af25f719989249"
    IssueInstant="2016-11-23T18:55:18.657Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:ucdavis.edu</saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_2f628b9bb0601cd242b67f0b2c697b13"
        IssueInstant="2016-11-23T18:55:18.657Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>urn:mace:incommon:ucdavis.edu</saml2:Issuer>
        <saml2:Subject>
            <saml2:NameID Format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                NameQualifier="urn:mace:incommon:ucdavis.edu"
                SPNameQualifier="https://xxxxxxx-ucdavis.kronos.net" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">XXXXXXX@ucdavis.edu</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="169.237.xx.xx"
                    NotOnOrAfter="2016-11-23T19:00:18.680Z" Recipient="https://xxxxxxx-ucdavis.kronos.net/wfc/logonWithUID"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2016-11-23T18:55:18.657Z" NotOnOrAfter="2016-11-23T19:00:18.657Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>https://xxxxxxx-ucdavis.kronos.net</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2016-11-23T18:55:08.973Z" SessionIndex="_b6d76bc422377d39492071e5a030810d">
            <saml2:SubjectLocality Address="169.237.xx.xx"/>
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>