<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class="">LOL about the logic. I thought the same. Hahahaha. <div class=""><br class=""></div><div class="">Ok forgive my ignorance here as I usually don’t have many problems with this, what’s the best way to trace this? Web browser? SAMLTRACER extension? But don’t I need unencrypted assertions otherwise it’s gonna be all gobble gook right? Also, my logs in shib look good to me for it. I see it sending my Mail attribute. </div><div class=""><br class=""></div><div class="">shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2022-01-27 23:37:25,638 - INFO [Shibboleth-Audit.SSO:283] - 2022-01-27T23:37:25.638103Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|DUO_5865aaf2ccf211d1a6cb78fc09cd90d6d971d12eabf3ac46d51f7609a946bdf5|<a href="https://admin-" class="">https://admin-</a><a href="http://ourduonumber.duosecurity.com/saml/OURDUOSTUFF/metadata|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://ourshibserver.manhattan.edu/idp/sh" class="">ourduonumber.duosecurity.com/saml/OURDUOSTUFF/metadata|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://ourshibserver.manhattan.edu/idp/sh</a>ibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fa30dd18e43297d0a286d029346f62d4|melvin.lasky||mail|||<br class=""><br class="">So I’m not even sure what to check LOL. It’s gotta be something stupid I have wrong somewhere.<br class=""><br class="">Mel<br class=""><br class=""><br class=""><div dir="ltr" class=""><!-- signature open --><div class=""><span class="" style="background-color: rgba(255, 255, 255, 0);"><font class=""><b class="">Melvin Lasky</b><br class="">Associate Director of Enterprise Architecture</font><br class=""></span></div><div class=""><span class="" style="background-color: rgba(255, 255, 255, 0);"><a href="x-apple-data-detectors://1/0" dir="ltr" x-apple-data-detectors="true" x-apple-data-detectors-type="address" x-apple-data-detectors-result="1/0" style="text-decoration-color: rgba(128, 128, 128, 0.38);" class="">Riverdale, NY 10471</a><br class="">Phone: <a href="tel:718-862-7410" dir="ltr" x-apple-data-detectors="true" x-apple-data-detectors-type="telephone" x-apple-data-detectors-result="1/1" style="text-decoration-color: rgba(128, 128, 128, 0.38);" class="">718-862-7410</a><br class=""><a href="mailto:melvin.lasky@manhattan.edu" class="">melvin.lasky@manhattan.edu</a><br class=""><a href="http://www.manhattan.edu/" dir="ltr" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="1/3" style="text-decoration-color: rgba(128, 128, 128, 0.38);" class="">www.manhattan.edu</a></span><br class=""></div><!-- signature close --></div><div dir="ltr" class=""><br class=""><blockquote type="cite" class="">On Jan 27, 2022, at 7:18 PM, Cantor, Scott <cantor.2@osu.edu> wrote:<br class=""><br class=""></blockquote></div><blockquote type="cite" class=""><div dir="ltr" class=""><span class="">On 1/27/22, 7:14 PM, "Melvin Lasky" <melvin.lasky@manhattan.edu> wrote:</span><br class=""><span class=""></span><br class=""><blockquote type="cite" class=""><span class=""> "I understand you're encountering the error outlined here, which is basically either the SAML assertion was</span><br class=""></blockquote><blockquote type="cite" class=""><span class="">encrypted when your IdP doesn't support encrypted assertions</span><br class=""></blockquote><span class=""></span><br class=""><span class="">That's a fascinating bit of logic.</span><br class=""><span class=""></span><br class=""><blockquote type="cite" class=""><span class=""> The Certificate for signing is in the Duo Metadata file. I double checked that looks right.</span><br class=""></blockquote><span class=""></span><br class=""><span class="">Well, an IdP can simply skip encryption if there's no key to use. Make sure the metadata file has a key marked for more than just signing, but more to the point, just trace it, don't waste time guessing what it's doing.</span><br class=""><span class=""></span><br class=""><span class="">-- Scott</span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""></div></blockquote></div></div></body></html>