<html><body><div dir="ltr">
I don’t recall so cannot explain why, but in our config for the Duo Admin panel we specify using ePPN for the nameID with a named format of “unspecified”.</div><div dir="ltr"><br></div><div dir="ltr">David Bantz</div><div dir="ltr"><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 27Jan2022 at 15:24:19, Melvin Lasky via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></div><div style="word-wrap:break-word;line-break:after-white-space" class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class="">LOL about the logic. I thought the same. Hahahaha. <div class=""><br class=""></div><div class="">Ok forgive my ignorance here as I usually don’t have many problems with this, what’s the best way to trace this? Web browser? SAMLTRACER extension? But don’t I need unencrypted assertions otherwise it’s gonna be all gobble gook right? Also, my logs in shib look good to me for it. I see it sending my Mail attribute. </div><div class=""><br class=""></div><div class="">shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2022-01-27 23:37:25,638 - INFO [Shibboleth-Audit.SSO:283] - 2022-01-27T23:37:25.638103Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|DUO_5865aaf2ccf211d1a6cb78fc09cd90d6d971d12eabf3ac46d51f7609a946bdf5|<a href="https://admin-" class="">https://admin-</a><a href="http://ourduonumber.duosecurity.com/saml/OURDUOSTUFF/metadata|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://ourshibserver.manhattan.edu/idp/sh" class="">ourduonumber.duosecurity.com/saml/OURDUOSTUFF/metadata|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://ourshibserver.manhattan.edu/idp/sh</a>ibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fa30dd18e43297d0a286d029346f62d4|melvin.lasky||mail|||<br class=""><br class="">So I’m not even sure what to check LOL. It’s gotta be something stupid I have wrong somewhere.<br class=""><br class="">Mel<br class=""><br class=""><br class=""><div dir="ltr" class=""><div class=""><span class="" style="background-color:rgba(255,255,255,0)"><font class=""><b class="">Melvin Lasky</b><br class="">Associate Director of Enterprise Architecture</font><br class=""></span></div><div class=""><span class="" style="background-color:rgba(255,255,255,0)"><a href="x-apple-data-detectors://1/0" dir="ltr" style="text-decoration-color:rgba(128,128,128,0.38)" class="">Riverdale, NY 10471</a><br class="">Phone: <a href="tel:718-862-7410" dir="ltr" style="text-decoration-color:rgba(128,128,128,0.38)" class="">718-862-7410</a><br class=""><a href="mailto:melvin.lasky@manhattan.edu" class="">melvin.lasky@manhattan.edu</a><br class=""><a href="http://www.manhattan.edu/" dir="ltr" style="text-decoration-color:rgba(128,128,128,0.38)" class="">www.manhattan.edu</a></span><br class=""></div></div><div dir="ltr" class=""><br class=""><blockquote type="cite" class="">On Jan 27, 2022, at 7:18 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br class=""><br class=""></blockquote></div><blockquote type="cite" class=""><div dir="ltr" class=""><span class="">On 1/27/22, 7:14 PM, "Melvin Lasky" <<a href="mailto:melvin.lasky@manhattan.edu">melvin.lasky@manhattan.edu</a>> wrote:</span><br class=""><span class=""></span><br class=""><blockquote type="cite" class=""><span class=""> "I understand you're encountering the error outlined here, which is basically either the SAML assertion was</span><br class=""></blockquote><blockquote type="cite" class=""><span class="">encrypted when your IdP doesn't support encrypted assertions</span><br class=""></blockquote><span class=""></span><br class=""><span class="">That's a fascinating bit of logic.</span><br class=""><span class=""></span><br class=""><blockquote type="cite" class=""><span class=""> The Certificate for signing is in the Duo Metadata file. I double checked that looks right.</span><br class=""></blockquote><span class=""></span><br class=""><span class="">Well, an IdP can simply skip encryption if there's no key to use. Make sure the metadata file has a key marked for more than just signing, but more to the point, just trace it, don't waste time guessing what it's doing.</span><br class=""><span class=""></span><br class=""><span class="">-- Scott</span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""></div></blockquote></div></div></div></div>
<div>
<div>
-- <br>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
</div></body></html>