<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 27, 2020, at 6:08 PM, Deirdre Kirmis <<a href="mailto:Deirdre.Kirmis@asu.edu" class="">Deirdre.Kirmis@asu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Yes, it was on the IDP side. They fixed it, and I see my IDP to choose to login, but now my web app thinks all of the accounts are new, so tries to add them, but then gives a 500 error. It’s like it thinks it is a new user and goes through the steps to add the account, gives the screen to the user to “accept” adding the account, but then gives a 500 error. The dev/prod IDP accounts use the same domain information, so should be the same.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Any ideas what would cause that behavior?<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></div></blockquote></div><div class=""><br class=""></div>No one could answer that without knowing your user creation logic, and that isn't an SP or IdP thing in any direct way. You'd have to look at the attribute(s) value(s) being sent by the Prod IdP and compare them to the "theoretically the same" attribute(s) value(s) being sent by the previous IdP. And then check your user matching and creation logic.<div class=""><br class=""></div><div class="">But one would also have to ask -- why would you want to keep user records from a test IdP in the first place? If moving to Prod, shouldn't you discard any such "test records"?</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>