<div dir="ltr"><div>Thanks to you I have finished my POC with Cyberark SAML SP. And, Scott, yes - you are right. It works with emailAddress instead of unspecified. <br></div><div><br></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 23 Apr 2019 at 08:56, Yakov Revyakin <<a href="mailto:yrevyakin@gmail.com">yrevyakin@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>>
probably not the last you'll have to work around. <br></div><div>You are right. I have got a completely equal responses but onelogin works, my IdPs doesn't.<br></div><div></div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"Courier New""><span style="color:rgb(232,191,106)"><samlp:Response </span><span style="color:rgb(186,186,186)">xmlns:saml=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:assertion" </span><span style="color:rgb(186,186,186)">xmlns:samlp=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:protocol"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">ID=</span><span style="color:rgb(106,135,89)">"R3d7e92dd685f70c498cd0b9896e1a7f783c0e604" </span><span style="color:rgb(186,186,186)">Version=</span><span style="color:rgb(106,135,89)">"2.0" </span><span style="color:rgb(186,186,186)">IssueInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:06:34Z"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">Destination=</span><span style="color:rgb(106,135,89)">"{recipient}" </span><span style="color:rgb(186,186,186)">InResponseTo=</span><span style="color:rgb(106,135,89)">"_40773862-3b39-4893-95bf-ab4bae437d35"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Issuer></span><a href="https://app.onelogin.com/saml/metadata/bb75756b-c825-43e2-80aa-9e057695f31c" target="_blank">https://app.onelogin.com/saml/metadata/bb75756b-c825-43e2-80aa-9e057695f31c</a><span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Issuer><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">samlp</span><span style="color:rgb(232,191,106)">:Status><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">samlp</span><span style="color:rgb(232,191,106)">:StatusCode </span><span style="color:rgb(186,186,186)">Value=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:status:Success"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">samlp</span><span style="color:rgb(232,191,106)">:Status><br></span><span style="color:rgb(232,191,106)"> <saml:Assertion </span><span style="color:rgb(186,186,186)">xmlns:saml=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:assertion" </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">xs</span><span style="color:rgb(186,186,186)">=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/XMLSchema" target="_blank">http://www.w3.org/2001/XMLSchema</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">xsi</span><span style="color:rgb(186,186,186)">=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>" </span><span style="color:rgb(186,186,186)">Version=</span><span style="color:rgb(106,135,89)">"2.0"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">ID=</span><span style="color:rgb(106,135,89)">"pfxe3cf1738-b942-11c0-36a4-cc746e4274f5" </span><span style="color:rgb(186,186,186)">IssueInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:06:34Z"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Issuer></span><a href="https://app.onelogin.com/saml/metadata/bb75756b-c825-43e2-80aa-9e057695f31c" target="_blank">https://app.onelogin.com/saml/metadata/bb75756b-c825-43e2-80aa-9e057695f31c</a><span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Issuer><br></span><span style="color:rgb(232,191,106)"> <ds:Signature </span><span style="color:rgb(186,186,186)">xmlns:ds=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignedInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:CanonicalizationMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Reference </span><span style="color:rgb(186,186,186)">URI=</span><span style="color:rgb(106,135,89)">"#pfxe3cf1738-b942-11c0-36a4-cc746e4274f5"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transforms><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transform </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transform </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transforms><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestValue></span>GCG1xw+LA/Ux/Y+YTCimQY8VH1E=<span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestValue><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Reference><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignedInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureValue><br></span><span style="color:rgb(232,191,106)"> </span>C5/p1yiry3g9RKcLvVaYNWOGvlTvK0+EAQr4hmUoPaH3oVW6iQ2D8dalbmyLZcmnCoU2T6ksC53dHJlIHTOJIwtP/u2cjAec9xHCtIdgoSXqgtFO8IjgIinCxfTFCd7yATxVga34waAwhDlTXpcw63V890PqSwPxrFDbKIVniFXBKVxHhdZ/uXKzoWb02LgOEiE0ISuU7SwEkOrBQO/POBVjwavATZhy+ph3LNdyIT6b1Ig2HNDud6XPsHiuPjdzmPAYWFWC3vDwx/2PoeUO9HKFBVqWlqdeadIVT0dgwi109KU+8cXij+lqegoqCSNQbXaOHwwVfYASOMER6i+0YQ==<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureValue><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:KeyInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Data><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Certificate><br></span><span style="color:rgb(232,191,106)"> </span>MIID6DCCAtCgAwIBAgIUGMQTIN+xMpATICP7HqdVVmS6SuwwDQYJKoZIhvcNAQEFBQAwSTEUMBIGA1UECgwLMmNvbXBseS5iaXoxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEaMBgGA1UEAwwRT25lTG9naW4gQWNjb3VudCAwHhcNMTkwMzAxMTUzMTQ3WhcNMjQwMzAxMTUzMTQ3WjBJMRQwEgYDVQQKDAsyY29tcGx5LmJpejEVMBMGA1UECwwMT25lTG9naW4gSWRQMRowGAYDVQQDDBFPbmVMb2dpbiBBY2NvdW50IDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKVcsDoZhfo5ro/2Ch4zoGfm9mwIhmwbzNtiTvHfjWbcm+qOZqjCydVmME4QIojOBB4LTPZRQgtZiqm3bjLH9ATcPMvLEiKMpEaooV/pHGlVpcx4PmwGjCCfolH+8GYgo9WMKCydbCkoD5psQ/h66LV6wx+hBgl0xzJAaRnuJ+hYL0bzRiAd9K2A37GJHVVMMFo+senVhhRw2LGuKsNlzFAbBRoHBODqXi1P/NCUqewBvl5YxD3VemtlwzPTzi2rWKLV7/bcGpSrStGdJNbeBVFNHRneX5qS6FPG1tzivWMdBbkcX5A9NF7LMPsZf4V5AhddrSIkBv3XlULei3WbzMMCAwEAAaOBxzCBxDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQjyql3UuxdmVumup/YRibCATp3JzCBhAYDVR0jBH0we4AUI8qpd1LsXZlbprqf2EYmwgE6dyehTaRLMEkxFDASBgNVBAoMCzJjb21wbHkuYml6MRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxGjAYBgNVBAMMEU9uZUxvZ2luIEFjY291bnQgghQYxBMg37EykBMgI/sep1VWZLpK7DAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQEFBQADggEBAEL/U5PCpefjG2ZP1qjImDKpJvyJl6PXZqwNQzK3B21UroFzezECJ5DqIuUvhqs2uDaHGVzehZzl04i06RI83ODqYNJ5Av/CsEVEzrG/qsvFHYFQ0/D0I3q8biGxdBCvWG4Duoa+TBamSKD+s2Z5wfTE7A42xiBdUtXsCPAVoGlysCOW44ehsZorxwBoMoQlSBRnw/5r+JgB9TcpCvHcy4L31PcrqWeOrfVLGOJ4bWNBz0xR1MpIOV7jcaLrnHFNfVgWqmvEVbjGIgEdv0yi18SgoFRBnxQxfTBjGsLgEi6mXMd+neKSV6dx2EuQgsI8wsMuF1EoIn+nLCAYYQWRLyM=<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Certificate><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Data><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:KeyInfo><br></span><span style="color:rgb(232,191,106)"> </ds:Signature><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Subject><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:NameID </span><span style="color:rgb(186,186,186)">Format=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"</span><span style="color:rgb(232,191,106)">></span><a href="mailto:yrevyakin@2comply.biz" target="_blank">yrevyakin@2comply.biz</a><br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:NameID><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:SubjectConfirmation </span><span style="color:rgb(186,186,186)">Method=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:cm:bearer"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:SubjectConfirmationData </span><span style="color:rgb(186,186,186)">NotOnOrAfter=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:09:34Z" </span><span style="color:rgb(186,186,186)">Recipient=</span><span style="color:rgb(106,135,89)">"{recipient}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">InResponseTo=</span><span style="color:rgb(106,135,89)">"_40773862-3b39-4893-95bf-ab4bae437d35"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:SubjectConfirmation><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Subject><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Conditions </span><span style="color:rgb(186,186,186)">NotBefore=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:03:34Z" </span><span style="color:rgb(186,186,186)">NotOnOrAfter=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:09:34Z"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AudienceRestriction><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Audience></span>{audience}<span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Audience><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AudienceRestriction><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:Conditions><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnStatement </span><span style="color:rgb(186,186,186)">AuthnInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:06:33Z" </span><span style="color:rgb(186,186,186)">SessionNotOnOrAfter=</span><span style="color:rgb(106,135,89)">"2019-04-24T05:06:34Z"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">SessionIndex=</span><span style="color:rgb(106,135,89)">"_7d2a2290-47b3-0137-7e04-25ca174fabc5"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnContext><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnContextClassRef></span>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnContextClassRef><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnContext><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml</span><span style="color:rgb(232,191,106)">:AuthnStatement><br></span><span style="color:rgb(232,191,106)"> </saml:Assertion><br></span><span style="color:rgb(232,191,106)"></samlp:Response></span></pre></div><br><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"Courier New""><span style="color:rgb(232,191,106)"><?</span><span style="color:rgb(186,186,186)">xml version=</span><span style="color:rgb(106,135,89)">"1.0" </span><span style="color:rgb(186,186,186)">encoding=</span><span style="color:rgb(106,135,89)">"UTF-8"</span><span style="color:rgb(232,191,106)">?><br></span><span style="color:rgb(232,191,106)"><saml2p:Response </span><span style="color:rgb(186,186,186)">Destination=</span><span style="color:rgb(106,135,89)">"<a href="https://components.cyberark.local/PasswordVault/api/auth/saml/logon" target="_blank">https://components.cyberark.local/PasswordVault/api/auth/saml/logon</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">ID=</span><span style="color:rgb(106,135,89)">"_3b858cb6f5771aadbbb9e979dacd393f" </span><span style="color:rgb(186,186,186)">InResponseTo=</span><span style="color:rgb(106,135,89)">"_05b5a5dc-2735-474a-a56c-02dcf7a2f068"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">IssueInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:47:08.843Z" </span><span style="color:rgb(186,186,186)">Version=</span><span style="color:rgb(106,135,89)">"2.0"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:saml2p=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:protocol"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <saml2:Issuer </span><span style="color:rgb(186,186,186)">xmlns:saml2=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:assertion"</span><span style="color:rgb(232,191,106)">></span><a href="https://testidp.hide.com/idp/shibboleth" target="_blank">https://testidp.hide.com/idp/shibboleth</a><br> <span style="color:rgb(232,191,106)"></saml2:Issuer><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2p</span><span style="color:rgb(232,191,106)">:Status><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2p</span><span style="color:rgb(232,191,106)">:StatusCode </span><span style="color:rgb(186,186,186)">Value=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:status:Success"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2p</span><span style="color:rgb(232,191,106)">:Status><br></span><span style="color:rgb(232,191,106)"> <saml2:Assertion </span><span style="color:rgb(186,186,186)">ID=</span><span style="color:rgb(106,135,89)">"_d141f25362802c7b09276e8ab70ec134" </span><span style="color:rgb(186,186,186)">IssueInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:47:08.843Z" </span><span style="color:rgb(186,186,186)">Version=</span><span style="color:rgb(106,135,89)">"2.0"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:saml2=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:assertion"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Issuer></span><a href="https://testidp.hide.com/idp/shibboleth" target="_blank">https://testidp.hide.com/idp/shibboleth</a><span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Issuer><br></span><span style="color:rgb(232,191,106)"> <ds:Signature </span><span style="color:rgb(186,186,186)">xmlns:ds=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignedInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:CanonicalizationMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Reference </span><span style="color:rgb(186,186,186)">URI=</span><span style="color:rgb(106,135,89)">"#_d141f25362802c7b09276e8ab70ec134"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transforms><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transform </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transform </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Transforms><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestMethod </span><span style="color:rgb(186,186,186)">Algorithm=</span><span style="color:rgb(106,135,89)">"<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestValue></span>KcdaZHp0T2LVbuovm75LGJrVp5A=<span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:DigestValue><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:Reference><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignedInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureValue><br></span><span style="color:rgb(232,191,106)"> </span>ly51sEdM7whnx4ZzfPkD+84DkbQsnzNQCB6suDiyF6CbA7WMubEwJZwUik3eEVYKZHtbvmf8PKbUDcLuyylqQ8/FMWG+FaK/gehgLtd+2ogjH6WNOKKfcL9oB5zO7xAnJqD8PV2lNvyLjG/XlYXAB8nQETopQGswyNJrek+dy/jyIAhOWB7o3n4330mxCjgsaAPX3Hz1TTwRHj+qICL96wQSQaF2IQnvIbUolspOxlmcYaQ2xNR4RRl1sMaCFerh4D61x/dC29CbTJzY2oKwhZBP7gC9I4jM4QSXy+a2v7L65JX/SdsygGPqv4o+1+9GGqTcuo7mU7NwR+kIY0wIRA==<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:SignatureValue><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:KeyInfo><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Data><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Certificate></span>MIID7zCCAtegAwIBAgIULGxdGH853pK5v+jzfL8J719EOK0wDQYJKoZIhvcNAQELBQAwgYYxCzAJ<br> BgNVBAYTAlVTMQswCQYDVQQIDAJUWDEOMAwGA1UEBwwFVGV4YXMxDzANBgNVBAoMBkhpZGVlejEO<br> MAwGA1UECwwFQXV0aE4xGzAZBgNVBAMMEnRlc3RpZHAuaGlkZWV6LmNvbTEcMBoGCSqGSIb3DQEJ<br> ARYNeXJAaGlkZWV6LmNvbTAeFw0xOTA0MTkxMDAxMjdaFw0yMDA0MTgxMDAxMjdaMIGGMQswCQYD<br> VQQGEwJVUzELMAkGA1UECAwCVFgxDjAMBgNVBAcMBVRleGFzMQ8wDQYDVQQKDAZIaWRlZXoxDjAM<br> BgNVBAsMBUF1dGhOMRswGQYDVQQDDBJ0ZXN0aWRwLmhpZGVlei5jb20xHDAaBgkqhkiG9w0BCQEW<br> DXlyQGhpZGVlei5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzIuNJSzZ/2rZF<br> BP+tB5h1/L8hcmxmvsrfrj5+F3XjIv3W9vXbkZGFuFFEMZO9iQ/1OtdvMStpaA8XqL09JUaBvUPj<br> 3muInGrY5mujCt/TY+EyWwfy1oDKsX/1FihuuRdXoz3s1auzZ6pcs6PTAe/cDy3P3VzG2Owyrf5p<br> xUEsx37UGPx76o1EX7SjYvYF11478MNWAfOhqDTclWEqORSS+LSh3ZraSgfAg3FXJ3hE4Bcuz3vA<br> LimxgbppkDhEa0cOJngSiOicwfrLvNx+l+zV+qDp9x2y/MbbaglgZTBLTRaZ/+uEZaLOcO4YbIAJ<br> 2Ny7T+vQ28tnL4dnxxqItA0HAgMBAAGjUzBRMB0GA1UdDgQWBBR9ttycbSZnqD8f6A3UYCKg6WrI<br> vTAfBgNVHSMEGDAWgBR9ttycbSZnqD8f6A3UYCKg6WrIvTAPBgNVHRMBAf8EBTADAQH/MA0GCSqG<br> SIb3DQEBCwUAA4IBAQBxDJAaAar4puAJRaGcPX+pqqqjCmuKp5DkdVMkaA58vGEF9gbomA3mah48<br> enXJ1bpaVJPlqBASpD47NcxpevWs6gBY/r+CaD9UbEpwkw1/Qwm8FmIvgMNjCS0141lEQ53Kzsec<br> 8b9PNygi+XVaszxznWYrkcqGlvJpt6GMM76/gfsxqNyVwsvXrZ2Q5SoQsB0YATi2sLie9pWHg5zu<br> eIr8Gd9mq29P7drXUeXSiK+bTIH7EqEJ2oust0tsU1EDPPEQDHmKa8i0i67Xsp7ndGvOytJKtkKX<br> aAzr9vKGgVb7be4C1qesygS6XrJJFVHKIPOr6vNqD2/9EoYmt7kX1BQl<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Certificate><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:X509Data><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">ds</span><span style="color:rgb(232,191,106)">:KeyInfo><br></span><span style="color:rgb(232,191,106)"> </ds:Signature><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Subject><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:NameID </span><span style="color:rgb(186,186,186)">Format=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">NameQualifier=</span><span style="color:rgb(106,135,89)">"<a href="https://testidp.hide.com/idp/shibboleth" target="_blank">https://testidp.hide.com/idp/shibboleth</a>" </span><span style="color:rgb(186,186,186)">SPNameQualifier=</span><span style="color:rgb(106,135,89)">"Cyberark4Hide"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> </span><a href="mailto:yrevyakin@2comply.biz" target="_blank">yrevyakin@2comply.biz</a><br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:NameID><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:SubjectConfirmation </span><span style="color:rgb(186,186,186)">Method=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:cm:bearer"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:SubjectConfirmationData </span><span style="color:rgb(186,186,186)">Address=</span><span style="color:rgb(106,135,89)">"184.170.232.49"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">InResponseTo=</span><span style="color:rgb(106,135,89)">"_05b5a5dc-2735-474a-a56c-02dcf7a2f068"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">NotOnOrAfter=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:52:09.007Z"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">Recipient=</span><span style="color:rgb(106,135,89)">"<a href="https://components.cyberark.local/PasswordVault/api/auth/saml/logon" target="_blank">https://components.cyberark.local/PasswordVault/api/auth/saml/logon</a>"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:SubjectConfirmation><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Subject><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Conditions </span><span style="color:rgb(186,186,186)">NotBefore=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:47:08.843Z" </span><span style="color:rgb(186,186,186)">NotOnOrAfter=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:52:08.843Z"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AudienceRestriction><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Audience></span>Cyberark4Hide<span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Audience><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AudienceRestriction><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Conditions><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnStatement </span><span style="color:rgb(186,186,186)">AuthnInstant=</span><span style="color:rgb(106,135,89)">"2019-04-23T05:47:03.295Z" </span><span style="color:rgb(186,186,186)">SessionIndex=</span><span style="color:rgb(106,135,89)">"_b0e52cde1efc767980ef67a817c353eb"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:SubjectLocality </span><span style="color:rgb(186,186,186)">Address=</span><span style="color:rgb(106,135,89)">"184.170.232.49"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnContext><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnContextClassRef></span>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br> <span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnContextClassRef><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnContext><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AuthnStatement><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AttributeStatement><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Attribute </span><span style="color:rgb(186,186,186)">FriendlyName=</span><span style="color:rgb(106,135,89)">"mail" </span><span style="color:rgb(186,186,186)">Name=</span><span style="color:rgb(106,135,89)">"urn:oid:0.9.2342.19200300.100.1.3"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">NameFormat=</span><span style="color:rgb(106,135,89)">"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AttributeValue></span><a href="mailto:yrevyakin@2comply.biz" target="_blank">yrevyakin@2comply.biz</a><span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AttributeValue><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:Attribute><br></span><span style="color:rgb(232,191,106)"> </</span><span style="color:rgb(152,118,170)">saml2</span><span style="color:rgb(232,191,106)">:AttributeStatement><br></span><span style="color:rgb(232,191,106)"> </saml2:Assertion><br></span><span style="color:rgb(232,191,106)"></saml2p:Response></span></pre><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 22 Apr 2019 at 23:08, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 4/22/19, 3:35 PM, "users on behalf of Yakov Revyakin" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:yrevyakin@gmail.com" target="_blank">yrevyakin@gmail.com</a>> wrote:<br>
<br>
> It looks like Cyberark doesn't recognize NameID section.<br>
<br>
I understand that you think it's a logical assumption that documentation and error messages are going to be meaningful, but the reality isn't that simple and I doubt that's what the error is.<br>
<br>
As for what's different, one has signed assertions and one has signed responses and signed assertions. So the inference is that they break on signed responses, which is a bug, probably not the last you'll have to work around.<br>
<br>
And once it's working more or less, then the final step is to test it with a real Format and see if it works, at which point you've proven you don't need "unspecified".<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
</blockquote></div>