<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">So going back to the original logic you had in the checkSecondFactor bean, it looks like you are trying to accomplish the following:</div><div class="gmail_default" style=""><ol style="font-family:arial,helvetica,sans-serif;font-size:small"><li>Require Duo for specific SPs</li><li>Allow other SPs to request Duo if they wish</li><li>Exclude certain users from having to use Duo as long as the SP did not request it</li></ol><font face="arial, helvetica, sans-serif">Out of curiosity, what do you have set for the following in idp.properties?</font></div><div class="gmail_default" style=""><ul><li>idp.authn.flows</li><li>idp.authn.favorSSO</li></ul></div><div class="gmail_default" style="">The behavior you're describing reminds of what we experienced years ago when setting this up. I found that I needed to set these as follows:</div><div class="gmail_default" style=""><ul><li>idp.authn.flows = MFA</li><li>idp.authn.favorSSO = false</li></ul></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">If your values are different, try going back to your original setup (i.e. controlling everything from mfa-authn-config.xml rather than replying-party.xml) and then set these two properties.</div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Aug 13, 2021 at 10:49 AM Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu">rullfig@uic.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I thought that would be it but it isn't, the SP rejects the identity now. relying party looks like this.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<!-- Force MFA here for relying parties THAT DON'T HAVE OTHER BEANS DEFINED IN THIS FILE -->
<div> <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'<a href="https://jostle.us" target="_blank">https://jostle.us</a>','<a href="http://box.net" target="_blank">box.net</a>'}}"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO"</div>
<div> p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"></div>
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <ref bean="MFASAML2Principal" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </list></div>
<div> </property></div>
</bean><br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_5403035491944621818Signature">
<div>
<div></div>
<div id="gmail-m_5403035491944621818divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_5403035491944621818ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig - <a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_5403035491944621818ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_5403035491944621818appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_5403035491944621818divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Brian Moon via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:41 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Cc:</b> Brian Moon <<a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
So that user exception code should be as follows:</div>
<div style="font-size:small"><font face="monospace">// Entitlement group excepted from Duo<br>
if( epe != null && epe.getValues().contains(new stringType("<a href="https://urldefense.com/v3/__https://shibboleth.uic.edu/entitlement/shibexemptfromduo__;!!MLMg-p0Z!RWNl66R_DIxq0inLCSwtMyzj2eL7aoFVJQpPjAsLSMEf3JmJl22-gdYonnYb$" target="_blank">https://shibboleth.uic.edu/entitlement/shibexemptfromduo</a>")) )<br>
{<br>
nextFlow = null;<br>
}</font><br>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
<br>
</div>
<div style="font-size:small"><span style="font-family:arial,helvetica,sans-serif">By having </span><font face="monospace">if( mfaCtx.isAcceptable() )</font><font face="arial, helvetica, sans-serif"> in there, you are still deferring
to what the SP wants rather than overriding it.</font></div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
<br>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
Cheers!</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><font face="arial, helvetica, sans-serif"><br>
Brian Moon<br>
<font size="1">Senior System Administrator, Enterprise Systems</font></font></div>
<div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font></div>
</div>
</div>
</div>
<br>
</div>
<br>
<div>
<div dir="ltr">On Fri, Aug 13, 2021 at 10:35 AM Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
...but then that breaks my code to have user exceptions in mfa-authn-config.xml. Is there a way to force it by application in relying-party yet still have a user exception?</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342Signature">
<div>
<div></div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:28 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
That was it, was too quick to remove the code I had in relying-party.</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_Signature">
<div>
<div></div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on
behalf of Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:15 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I had been using relying-party before but wanted more control so moved everything entirely to mfa-authn-config.xml. I can try with some of the old relying party code again, thanks.</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_Signature">
<div>
<div></div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on
behalf of Brian Moon via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:11 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Cc:</b> Brian Moon <<a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
<div>Hello Roberto,</div>
<div><br>
</div>
<div>Check out this bit of documentation here: <a href="https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam04.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fspaces*2FKB*2Fpages*2F1474297850*2FSupporting*2Bthe*2BREFEDS*2BMFA*2BProfile*26data*3D04*7C01*7Crullfig*40uic.edu*7C258bf517821b4285086108d95e7df309*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644717300972742*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DkzRqsYVnFdjgtwE*2ByLkXfdxSae77TaUeHPJXf9GQq6c*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZQKaAAn8*24&data=04*7C01*7Crullfig*40uic.edu*7Cacce3c51f35545d13f3708d95e8194e2*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644732916321248*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=YQk*2FxoU39ofqiXn*2BCwiQ6DIfDxJF2N0fSd94HI1K4Ww*3D&reserved=0__;JSUlJSUlJSUlJSUqKioqKioqKioqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUlJQ!!MLMg-p0Z!RWNl66R_DIxq0inLCSwtMyzj2eL7aoFVJQpPjAsLSMEf3JmJl22-gQ2haHoo$" target="_blank">
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1474297850/Supporting+the+REFEDS+MFA+Profile</a></div>
<div><br>
</div>
<div>Basically what you need to do is ensure that you are directing everything to the MFA flow. Within the MFA flow, follow the example to check to see if a second factor is needed and then pass on control as needed.</div>
<div><br>
</div>
<div>You will also need to ensure that you have the MFA principals defined and then use conf/relying-party.xml to require MFA for certain SPs.</div>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small"><br>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">Hope that helps</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><font face="arial, helvetica, sans-serif"><br>
Brian Moon<br>
<font size="1">Senior System Administrator, Enterprise Systems</font></font></div>
<div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font></div>
</div>
</div>
</div>
<br>
</div>
<br>
<div>
<div dir="ltr">On Fri, Aug 13, 2021 at 10:02 AM Wessel, Keith <<a href="mailto:kwessel@illinois.edu" target="_blank">kwessel@illinois.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p>That’s not true if you hve MFA configured properly. The second MFA should see that the currently satisfied authentication methods isn’t sufficient and should prompt the user for step-up authentication. That is, it’ll skip asking the user for their username
and password again but will go straight to the MFA prompt.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Keith<u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Ullfig, Roberto Alfredo<br>
<b>Sent:</b> Friday, August 13, 2021 11:56 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Forcing MFA for some SPs and not Others<u></u><u></u></p>
</div>
</div>
<p><u></u> <u></u></p>
<div>
<p><span style="font-size:12pt;color:black">Is there a way for Shibboleth to create different cookies for different SPs? For instance, if I force MFA on an application on the IDP side I can easily get around MFA by logging into another SP that doesn't require
MFA first because I've already identified myself.<u></u><u></u></span></p>
</div>
<div>
<div>
<p><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_x_gmail-m_-1375537791944571034Signature">
<div>
<div id="gmail-m_5403035491944621818x_gmail-m_-7510134759823413342x_x_x_gmail-m_-1375537791944571034divtagdefaultwrapper">
<div>
<p style="background:white"><span style="font-size:10pt;font-family:Tahoma,sans-serif;color:black">---
<u></u><u></u></span></p>
<div>
<p style="background:white"><span style="font-size:10pt;font-family:Arial,sans-serif;color:black">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a><br>
Systems Administrator<br>
Enterprise Applications & Services | Technology Solutions<br>
University of Illinois - Chicago</span><span style="font-size:10pt;font-family:Tahoma,sans-serif;color:black">
<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam04.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fx*2FZYEpPw__*3B!!MLMg-p0Z!WKibHMkiKehbRt_aA4QztTnM5sRY5yu43iAKRJPn2yGtdRNId64dO-3wEJMV*24*26data*3D04*7C01*7Crullfig*40uic.edu*7C258bf517821b4285086108d95e7df309*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644717300972742*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DLiLk0q5NstfLI39*2FAydfbI1p0C4kNnn3Sde3bweLJds*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWFLifAW*24&data=04*7C01*7Crullfig*40uic.edu*7Cacce3c51f35545d13f3708d95e8194e2*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644732916331210*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=8kXvC7KK3rSRpjgc06mnxODLwwxfNMF0*2F7KWaQExXPQ*3D&reserved=0__;JSUlJSUlJSUlJSUqKioqKioqKioqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!RWNl66R_DIxq0inLCSwtMyzj2eL7aoFVJQpPjAsLSMEf3JmJl22-gZzdtNwx$" rel="noreferrer" target="_blank">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!WKibHMkiKehbRt_aA4QztTnM5sRY5yu43iAKRJPn2yGtdRNId64dO-3wEJMV$</a>
<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fx*2FZYEpPw__*3B!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWi4nnHM*24&data=04*7C01*7Crullfig*40uic.edu*7Cacce3c51f35545d13f3708d95e8194e2*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644732916331210*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=988Yl98tVXBjS4u3Fd*2Fx6Wm5FNaQFtMyL7dfbg7BMzM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!RWNl66R_DIxq0inLCSwtMyzj2eL7aoFVJQpPjAsLSMEf3JmJl22-gf3LwI_e$" rel="noreferrer" target="_blank">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWi4nnHM$</a>
<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
</blockquote></div>