<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:820848574;
mso-list-template-ids:-1267680510;}
@list l0:level1
{mso-level-start-at:3;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:1437289983;
mso-list-template-ids:-881690152;}
@list l2
{mso-list-id:1740247793;
mso-list-template-ids:-1869439110;}
@list l2:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<div id="mail-editor-reference-message-container">
<div>
<div>
<p class="MsoNormal"><span style="font-size:14.0pt;color:#212121">We are in the initial phases of a project where we have been asked to investigate the use of our Shibboleth IdP as a proxy. <span class="apple-converted-space"> </span></span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">I found this doc,<span class="apple-converted-space"> </span><a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP" title="Original URL:
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP
Click to follow link."><span style="color:#0078D7">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP</span></a><span class="apple-converted-space"> </span>,
and I believe that at this point I have a test IdP that has been configured for proxying (no service
</span><span style="font-size:14.0pt">available for <span style="color:#212121">testing yet). However I have some general questions that I hope someone will be kind enough to answer or point me to doc’s where I can do my own research.</span></span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">My questions:</span><o:p></o:p></p>
<ol style="margin-top:0in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px" start="1" type="1">
<li class="MsoListParagraph" style="color:#212121;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo1">
<span style="font-size:14.0pt">For the Shibboleth IdP, is proxying an all or none proposition? In other words, with proxying configured, can the
</span><span style="font-size:14.0pt;color:windowtext">Shibboleth </span><span style="font-size:14.0pt">IdP still perform normal authentication or do all authentication requests now have to go to the upstream IdP?</span><o:p></o:p></li></ol>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<ol style="margin-top:0in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px" start="2" type="1">
<li class="MsoListParagraph" style="color:#212121;margin-top:0in;margin-bottom:0in;mso-list:l2 level1 lfo2">
<span style="font-size:14.0pt">From the SP perspective, would current SP’s that use the IdP for authentication and that do not require proxying have to make changes with their configurations? I ask this from the perspective that the SAML assertion is typically
signed by the Shibboleth IdP and that the SP ‘knows’ the Shibboleth IdP based on the Shibboleth IdP’s SAML metadata which contains the signing cert.</span><o:p></o:p></li></ol>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<ol style="margin-top:0in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px" start="3" type="1">
<li class="MsoListParagraph" style="margin-top:0in;margin-bottom:0in;mso-list:l0 level1 lfo3">
<span style="font-size:14.0pt;color:#212121">One of the steps the docs specifically mentions is that I change the idp.authn.flows to ‘SAML’ (we currently use idp.authn.flows = MFA). As soon as I make this change to ‘idp.authn.flows = SAML’, all auth requests
that previously worked break with the error </span><span style="font-size:14.0pt">below<span style="color:#212121">. The IdP starts up with no errors and the error is displayed</span> during authentication
<span style="color:#212121">in the browser prior to getting to the IdP login page and in the IdP logs</span>.</span><o:p></o:p></li></ol>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in">
<span style="font-size:14.0pt;color:#212121">The relevant error from the logs seems to be ‘<b>No metadata returned for<span class="apple-converted-space"> </span><a href="https://upstream.idp/entity" title="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fupstream.idp%2Fentity&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499375103%7CUnknown%7CTWFpbGZsb3d8eyJWIj"><span style="font-size:11.0pt;color:#0078D7">https://upstream.idp/entity</span></a><span class="apple-converted-space"> </span>in
role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol’. <span class="apple-converted-space"> </span></b>This does make sense since I have not added the metadata for the upstream IdP but it makes me think
that now all SP requests for authentication will be routed to the upstream IdP which is unwanted behavior.</span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoNormal" style="font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> Is this expected behavior</span><span style="font-size:14.0pt">?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt"> <span style="color:#212121">As concerns SP’s that I do not want to use the IdP as a proxy,
</span> i<span style="color:#212121">s my understanding of the current behavior correct?</span></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<b><span style="font-size:14.0pt;color:#212121">(displayed in browser)</span></b><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">opensaml::FatalProfileException</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">The system encountered an error at Wed Jan 24 14:46:19 2024</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">To report this problem, please contact the site administrator at<span class="apple-converted-space"> </span><a href="mailto:webgroup@emory.edu" title="mailto:webgroup@emory.edu"><span style="font-size:11.0pt;color:#0078D7">webgroup@emory.edu</span></a>.</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">Please include the following message in any email:</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">opensaml::FatalProfileException at (<a href="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST" title="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST"><span style="font-size:11.0pt;color:#0078D7">https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST</span></a>)</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">SAML response reported an IdP error.</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">Error from identity provider:</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> Status: urn:oasis:names:tc:SAML:2.0:status:Requester</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> Message: An error occurred.</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<b><span style="font-size:14.0pt;color:#212121"> </span></b><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<b><span style="font-size:14.0pt;color:#212121">(from IdP logs)</span></b><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:03,853 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- DEBUG [PROTOCOL_MESSAGE:124] -<span class="apple-converted-space"> </span></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"><?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL=<a href="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST" title="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST"><span style="font-size:11.0pt;color:#0078D7">https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST</span></a>Destination=<a href="https://login.emory.edu/idp/profile/SAML2/Redirect/SSO" title="https://login.emory.edu/idp/profile/SAML2/Redirect/SSO"><span style="font-size:11.0pt;color:#0078D7">https://login.emory.edu/idp/profile/SAML2/Redirect/SSO</span></a>ID="_96ad81269e572890e407955190fd4fc4"
IssueInstant="2024-01-24T19:50:03Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://secure.web.emory.edu/%3c/saml:Issuer" title="https://secure.web.emory.edu/%3c/saml:Issuer"><span style="font-size:11.0pt;color:#0078D7">https://secure.web.emory.edu/</saml:Issuer</span></a>></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <samlp:NameIDPolicy AllowCreate="1"/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"></samlp:AuthnRequest></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,050 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:161]
- Message Handler: No metadata returned for<span class="apple-converted-space"> </span><a href="https://upstream.idp/entity" title="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fupstream.idp%2Fentity&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499382508%7CUnknown%7CTWFpbGZsb3d8eyJWIj"><span style="font-size:11.0pt;color:#0078D7">https://upstream.idp/entity</span></a><span class="apple-converted-space"> </span>in
role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,058 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170]
- Profile Action SelectProfileConfiguration: Profile<span class="apple-converted-space"> </span><a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fshibboleth.net%2Fns%2Fprofiles%2Fsaml2%2Fsso%2Fbrowser&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C63841723249938911"><span style="font-size:11.0pt;color:#0078D7">http://shibboleth.net/ns/profiles/saml2/sso/browser</span></a><span class="apple-converted-space"> </span>is
not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID<span class="apple-converted-space"> </span><a href="https://upstream.idp/entity" title="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fupstream.idp%2Fentity&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499395657%7CUnknown%7CTWFpbGZsb3d8eyJWIj"><span style="font-size:11.0pt;color:#0078D7">https://upstream.idp/entity</span></a>)</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,059 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile
Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,059 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile
Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,127 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- DEBUG [PROTOCOL_MESSAGE:70] -<span class="apple-converted-space"> </span></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"><?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination=<a href="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST" title="https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST"><span style="font-size:11.0pt;color:#0078D7">https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST</span></a>ID="_01bd307ec9db399a264379e8a1af69a6"
InResponseTo="_96ad81269e572890e407955190fd4fc4" IssueInstant="2024-01-24T19:50:04.062Z" Version="2.0"></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://login.emory.edu/idp/shibboleth%3c/saml2:Issuer" title="https://login.emory.edu/idp/shibboleth%3c/saml2:Issuer"><span style="font-size:11.0pt;color:#0078D7">https://login.emory.edu/idp/shibboleth</saml2:Issuer</span></a>></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:Signature xmlns:ds=<a href="http://www.w3.org/2000/09/xmldsig#" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499402196%7CUnknown%7CTWFpb"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2000/09/xmldsig#</span></a>></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:SignedInfo></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:CanonicalizationMethod Algorithm=<a href="http://www.w3.org/2001/10/xml-exc-c14n#" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2001%2F10%2Fxml-exc-c14n%23&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499408672%7CUnknown%7C"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2001/10/xml-exc-c14n#</span></a>/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:SignatureMethod Algorithm=<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499415297%7C"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</span></a>/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:Reference URI="#_01bd307ec9db399a264379e8a1af69a6"></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:Transforms></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:Transform Algorithm=<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23enveloped-signature&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C63841723249942195"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2000/09/xmldsig#enveloped-signature</span></a>/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:Transform Algorithm=<a href="http://www.w3.org/2001/10/xml-exc-c14n#" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2001%2F10%2Fxml-exc-c14n%23&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499428645%7CUnknown%7C"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2001/10/xml-exc-c14n#</span></a>/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:Transforms></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:DigestMethod Algorithm=<a href="http://www.w3.org/2001/04/xmlenc#sha256" title="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmlenc%23sha256&data=05%7C02%7Cgerry.hall%40emory.edu%7Ce219a690e8a542a06f5008dc1d172894%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638417232499435276%7CUnknown%7C"><span style="font-size:11.0pt;color:#0078D7">http://www.w3.org/2001/04/xmlenc#sha256</span></a>/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:DigestValue>3f35gnxlyq7pvzLDHXbi0gv+51DCKIa9BCCOKQU7eUI=</ds:DigestValue></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:Reference></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:SignedInfo></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:SignatureValue>HDikBaYNPz++PpScmOF4mNtKOdFWKBg7QOz1k932A461WMgsn1dpCE7RQZG+PacTWrjojOEW64jv1/mCroWteTY8MbXbOSVG8ldYplghkM6qcHNtdjztN25SbkZnTl6c69h8gpTbve06BZ/QGMagnTCXWxbRPrqxz/6QFg6Dc+zuJJoAaLUaVUR0NUHX9xLcSMD5SnksFxtAa71MbiLO+ZT2oRGlMCipAI5soxZ1FWGTk1cQ8l622houPRp9aOing0L9UxwBucZ+jJBkv7GwgAkBssy1AG6KkGQTdgxyXkNIWaX/eAVLjy7uo3lTirD0gz2pq0l2Fhlp5jEmcEUPCA==</ds:SignatureValue></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:KeyInfo></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:X509Data></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <ds:X509Certificate>MIIDJzCCAg+gAwIBAgIUfGsUnIe4ehQbVOK7801PiWLKSX8wDQYJKoZIhvcNAQEFBQAwGjEYMBYG</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">A1UEAxMPbG9naW4uZW1vcnkuZWR1MB4XDTEwMDMyOTE2MjAwNVoXDTMwMDMyOTE2MjAwNVowGjEY</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">MBYGA1UEAxMPbG9naW4uZW1vcnkuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">0RQxoj9S3eD6vcGOB39jZiPBRx1fTJf6MV96bHNwD/M+fBCR7t+07VScdH0pffvN0x7g5co0jWJ4</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">KT/16tPpA/14qzpKd3oHIFz5rgnG1qBSla+kqe9lzls72HMDA5vdaRpPib1ZsaB7JUyTTHMdvVcy</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">aovLILB/xt2cdy8CCJjIdNt+Uxl5gAwhKfU6DVYspFAWp4uVMJqO774Xn5Sa68ANjrRLTbMO7Bnq</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">gxCyAAN8ztGlsn+91Z5JnlMPI/q9uLh6xiUffiwo17S9KOQ+hqQx6XDQGI/U7TOanuohkC29qt09</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">tLYFXjAB3sfy66qsQfS/rXulScfJsSYNaziMaQIDAQABo2UwYzBCBgNVHREEOzA5gg9sb2dpbi5l</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">bW9yeS5lZHWGJmh0dHBzOi8vbG9naW4uZW1vcnkuZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQW</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">BBSC4HCY5liG+oEdDcyxnHhEZt8cKjANBgkqhkiG9w0BAQUFAAOCAQEAFdOSL9HrkUxokD0zm07e</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">gEpnltaHsusrsZvVhayfNqiRlgvhHBpJTa9xUaAyZ45VUsieP4olSdfyiMVMIRkVgo/gF4W//ZlG</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">xV28CnlalLR10NMzG6Kz03eRf6v5MQtVL+0EBTO7wiZAFIKYOv8nxpZoL7LV9l9x5SIDjsgmwV7w</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">Publ0X3aoGq6+IHIk1TZAA/xWJm1Z1W9fFRWXSLVS1/eCjPY4rjIktauEsi8Tj6QlhYFuo5WiEaV</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">tNluIP3MzpBSxCUyEov49a4rxpHNKPxpSZyFGTDS8Zsm6tV8cZfn0eCypcm3lqm/X3HSODuN6n5+</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">cVrRig01srF/2D9B1A==</ds:X509Certificate></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:X509Data></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:KeyInfo></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </ds:Signature></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml2p:Status></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </saml2p:StatusCode></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </saml2p:Status></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"></saml2p:Response></span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121">2024-01-24 14:50:04,128 - 127.0.0.1 -<span class="apple-converted-space"> </span>login.emory.edu<span class="apple-converted-space"> </span>- INFO [Shibboleth-Audit.SSO:338] - 2024-01-24T19:50:04.128577Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_96ad81269e572890e407955190fd4fc4|<a href="https://secure.web.emory.edu/%7Chttp:/shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps:/login.emory.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_01bd307ec9db399a264379e8a1af69a6%7C%7C%7C%7CMozilla/5.0"><span style="font-size:11.0pt;color:#0078D7">https://secure.web.emory.edu/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.emory.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_01bd307ec9db399a264379e8a1af69a6||||Mozilla/5.0</span></a><span class="apple-converted-space"> </span>(X11;
Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0||urn:oasis:names:tc:SAML:2.0:status:Requester|</span><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<b><span style="font-size:14.0pt;color:#212121"> </span></b><o:p></o:p></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;font-variant-caps:normal;orphans:auto;text-align:start;widows:auto;word-spacing:0px">
<span style="font-size:14.0pt;color:#212121"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:14.0pt"> </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>