<div dir="ltr">I did not look in great detail, but I do not see an attribute-filter rule (release policy) for <a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp" target="_blank" style="font-family:monospace">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a><br><font face="monospace"><br>Look at the sample in the file you copied:<br></font><span style="font-family:monospace"> <AttributeFilterPolicy id="example1"></span><br style="font-family:monospace"><span style="font-family:monospace"> <PolicyRequirementRule xsi:type="Requester" value="</span><a href="https://sp.example.org/" target="_blank" style="font-family:monospace">https://sp.example.org</a><span style="font-family:monospace">" /></span><br style="font-family:monospace"><br style="font-family:monospace"><span style="font-family:monospace"> <AttributeRule attributeID="uid" permitAny="true" /></span><br style="font-family:monospace"><span style="font-family:monospace"> </AttributeFilterPolicy></span><font face="monospace"></font><div><span style="font-family:monospace"><br>That releases "uid" to </span><a href="https://sp.example.org/" target="_blank" style="font-family:monospace">https://sp.example.org</a><br><br>You can build something parallel. Yes there are lots of more clever versions of attribute policy rules, but you might try that bottom rung level first.</div><div><br></div><div>Of course, you should also turn up the logging level for idp-process.log which can tell you in painful detail of every step along the way.</div><div><br></div><div>David St Pierere Bantz</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Jul 11, 2025 at 6:28 PM Michael B Allen via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I'm trying to learn SAML (from zero) so I set up a Shibboleth 5.1.4 IdP and a minimalistic spring boot SP. <br><br>It works, I'm authenticated, I get redirected back to the SP but ... I can't get attribute release working.</div><div><br></div><div>The SAMLResponse has no AttributeStatement (see very bottom of message for SAMLResponse.xml).</div><div><br></div><div>I understand the basic export then filter but I'm blurry on how it all should be used in practice.<br></div><div><br>Maybe someone can spot the failure?<br><br>Clearly Shibboleth is targeting the University / Research community but I work more with the Enterprise crowd.<br><br>So I'm using the KerberosValidator and LDAPConnector with Active Directory (confirmed in WireShark decrypted with sslkeylog LDAP search is working) and trying to release the sAMAccountName as an attribute.</div><div><br>The docs gave me the impression that I just needed to do exportAttributes="sAMAccountName" and <AttributeRule attributeID="sAMAccountName" permitAny="true"/> but there is simply no AttributeStatement in the SAMLResponse.<br><br>I thought maybe the SP needed to explicitly request with RequestedAttribute so I manually added it to the sp metadata but that had no effect.<br><br>Output of aacli shows no error but nothing interesting:<br><span style="font-family:monospace"><br>$ bin/aacli.sh -n dev@TECH.CORP -r '<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp" target="_blank">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>'<br>(<a href="https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP" target="_blank">https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP</a>) <a href="https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP" target="_blank">https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP</a></span><br><br>Again, I'm a total SAML newb so any general guidance about good Shibboleth practices (particularly in an Enterprise environment) would be greatly appreciated.<br><br>Below are various files that I *think* are important but heavily trimmed for reasonable email consumption.<br><br>Can anyone recommend diagnostics?<br><br>Mike<br><br><span style="font-family:monospace">--8<--<br>conf/idp.properties<br><br>idp.entityID=<a href="https://idp.tech.corp:8443/idp/shibboleth" target="_blank">https://idp.tech.corp:8443/idp/shibboleth</a><br>idp.scope=tech.corp<br><br>--8<--<br>conf/services.properties<br><br>idp.service.relyingparty.ignoreUnmappedEntityAttributes=true<br><br>idp.service.attribute.registry.checkInterval = PT15M<br>idp.service.attribute.registry.encodeType = false<br>idp.service.attribute.resolver.checkInterval = PT15M<br>idp.service.attribute.filter.checkInterval = PT15M<br><br>--8<--</span></div><div><span style="font-family:monospace">conf/metadata-providers.xml<br><br> <MetadataProvider id="LocalMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/spring-demo-sp-metadata.xml"/><br><br>--8<--<br>conf/relying-party.xml<br><br> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"><br> <property name="profileConfigurations"><br> <list><br> <ref bean="SAML2.SSO" /><br> <ref bean="SAML2.ECP" /><br> <ref bean="SAML2.Logout" /><br> <!--<br> <ref bean="SAML2.AttributeQuery" /><br> --><br> <ref bean="SAML2.ArtifactResolution" /><br> </list><br> </property><br> </bean><br><br> <util:list id="shibboleth.RelyingPartyOverrides"><br> <bean id="ExampleSP" parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp" target="_blank">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="SAML2.SSO" p:encryptAssertions="false" /><br> </list><br> </property><br> </bean><br> </util:list><br><br>--8<--<br>conf/saml-nameid.xml<br><br> <util:list id="shibboleth.SAML2NameIDGenerators"><br> <ref bean="shibboleth.SAML2TransientGenerator" /><br> </util:list><br><br>--8<--<br>conf/services.xml<br></span></div><span style="font-family:monospace"> <util:list id="shibboleth.RelyingPartyResolverResources"><br> <value>%{idp.home}/conf/relying-party.xml</value><br> <value>%{idp.home}/conf/credentials.xml</value><br> </util:list><br><br> <util:list id="shibboleth.MetadataResolverResources"><br> <value>%{idp.home}/conf/metadata-providers.xml</value><br> </util:list><br><br> <util:list id ="shibboleth.AttributeResolverResources"><br> <value>%{idp.home}/conf/attribute-resolver.xml</value><br> </util:list><br><br> <util:list id ="shibboleth.AttributeRegistryResources"><br> <value>%{idp.home}/conf/attribute-registry.xml</value><br> <value>%{idp.home}/conf/attributes/default-rules.xml</value><br> <value>%{idp.home}/conf/attribute-resolver.xml</value><br> </util:list><br><br> <util:list id ="shibboleth.AttributeFilterResources"><br> <value>%{idp.home}/conf/attribute-filter.xml</value><br> </util:list><br><br> <util:list id ="shibboleth.NameIdentifierGenerationResources"><br> <value>%{idp.home}/conf/saml-nameid.xml</value><br> </util:list><br><br> <util:list id="shibboleth.AccessControlResources"><br> <value>%{idp.home}/conf/access-control.xml</value><br> </util:list><br><br>--8<--<br>conf/attribute-registry.xml<br><br> <bean parent="shibboleth.TranscodingRuleLoader"<br> c:dir="%{idp.home}/conf/attributes/custom"<br> c:extensions="#{{'.txt', '.props', '.properties', '.rule'}}" /><br><br>--8<--<br>conf/attribute-resolver.xml<br><br> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br> startTLSTimeout="%{idp.attribute.resolver.LDAP.startTLSTimeout}"<br> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"<br> connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"<br> noResultIsError="true"<br> multipleResultsIsError="true"<br> excludeResolutionPhases="c14n/attribute"<br> exportAttributes="sAMAccountName mail displayName sn givenName departmentNumber employeeNumber eduPersonEntitlement eduPersonAssurance"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br> <ConnectionPool<br> minPoolSize="%{idp.pool.LDAP.minSize:3}"<br> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br> validateDN="%{idp.pool.LDAP.validateDN:}"<br> validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"<br> validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"<br> prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"<br> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/><br> </DataConnector><br><br>--8<--<br>conf/attribute-filter.xml<br><br> <AttributeFilterPolicy id="alwaysRelease"><br> <PolicyRequirementRule xsi:type="ANY" /><br><br> <AttributeRule attributeID="sAMAccountName" permitAny="true" /><br> </AttributeFilterPolicy><br><br> <AttributeFilterPolicy id="Per-Attribute-singleValued"><br> <PolicyRequirementRule xsi:type="ANY" /><br><br> <AttributeRule attributeID="eduPersonPrincipalName"><br> <PermitValueRule xsi:type="EntityAttributeExactMatch"<br> attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues" target="_blank">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="eduPersonPrincipalName" /><br> </AttributeRule><br> <AttributeRule attributeID="mail"><br> <PermitValueRule xsi:type="EntityAttributeExactMatch"<br> attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues" target="_blank">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="mail" /><br> </AttributeRule><br> </AttributeFilterPolicy><br><br> <AttributeFilterPolicy id="Per-Attribute-Affiliation"><br> <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"<br> attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues" target="_blank">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="eduPersonScopedAffiliation" /><br><br> <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" /><br> </AttributeFilterPolicy><br><br> <AttributeFilterPolicy id="subject-identifiers"><br> <PolicyRequirementRule xsi:type="ANY" /><br><br> <AttributeRule attributeID="samlPairwiseID"><br> <PermitValueRule xsi:type="OR"><br> <Rule xsi:type="EntityAttributeExactMatch"<br> attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="pairwise-id" /><br> <Rule xsi:type="EntityAttributeExactMatch"<br> attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="any" /><br> </PermitValueRule><br> </AttributeRule><br><br> <AttributeRule attributeID="samlSubjectID"><br> <PermitValueRule xsi:type="EntityAttributeExactMatch"<br> attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br> attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> attributeValue="subject-id" /><br> </AttributeRule><br> </AttributeFilterPolicy><br><br> <AttributeFilterPolicy id="example1"><br> <PolicyRequirementRule xsi:type="Requester" value="<a href="https://sp.example.org" target="_blank">https://sp.example.org</a>" /><br><br> <AttributeRule attributeID="uid" permitAny="true" /><br> </AttributeFilterPolicy><br><br> <AttributeFilterPolicy id="example2"><br> <PolicyRequirementRule xsi:type="OR"><br> <Rule xsi:type="Requester" value="<a href="https://sp.example.org" target="_blank">https://sp.example.org</a>" /><br> <Rule xsi:type="Requester" value="<a href="https://another.example.org/shibboleth" target="_blank">https://another.example.org/shibboleth</a>" /><br> </PolicyRequirementRule><br> <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" /><br> </AttributeFilterPolicy><br><br>--8<--<br>metadata/idp-metadata.xml<br><br><md:EntityDescriptor entityID="<a href="https://idp.tech.corp:8443/idp/shibboleth" target="_blank">https://idp.tech.corp:8443/idp/shibboleth</a>" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br> <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br> <md:Extensions><br> <shibmd:Scope regexp="false">tech.corp</shibmd:Scope><br> <mdui:UIInfo><br> <mdui:DisplayName xml:lang="en">A name for the IdP at idp.tech.corp</mdui:DisplayName><br> <mdui:Description xml:lang="en">Enter a description for the IdP at idp.tech.corp</mdui:Description><br> <mdui:Logo xml:lang="en" width="80" height="80"><a href="https://idp.tech.corp:8443/path/to/logo.png" target="_blank">https://idp.tech.corp:8443/path/to/logo.png</a></mdui:Logo><br> </mdui:UIInfo><br> </md:Extensions><br> <md:KeyDescriptor use="signing"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIELDCCApSgAwIBAgIVAK484vuVe9lKp/8o/7eobxivCsMMMA0GCSqGSIb3DQEBCwUAMBsxGTAX<br>...<br>RUNnmUC5BXD2Z1RtTousKNzX2d2q5LGzej8heIF7mXmqZhEccG8Eib0h6Nk0XQ==<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:KeyDescriptor use="signing"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEKzCCApOgAwIBAgIUL6IhHqoVAEx3htbU+AB8F8KQeXowDQYJKoZIhvcNAQELBQAwGzEZMBcG<br>...<br>v3Q0iVZWuNVwsWCyZ1FGTpUcraXGR/s3SMa+449/0VbjCiNsx6f/mBhDD3y2<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:KeyDescriptor use="encryption"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEKzCCApOgAwIBAgIUUyTDN5iEAgu/crWPHUJvAiuXuzEwDQYJKoZIhvcNAQELBQAwGzEZMBcG<br>...<br>ZmpOy1+Qvfc1RXuUpJc/qpxfjAKDuxWZnveE0EHIqt4Sogb1CZyJ732m0ste<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/SOAP/ArtifactResolution" target="_blank">https://idp.tech.corp:8443/idp/profile/SAML2/SOAP/ArtifactResolution</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/POST-SimpleSign/SSO" target="_blank">https://idp.tech.corp:8443/idp/profile/SAML2/POST-SimpleSign/SSO</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/Redirect/SSO" target="_blank">https://idp.tech.corp:8443/idp/profile/SAML2/Redirect/SSO</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/POST/SSO" target="_blank">https://idp.tech.corp:8443/idp/profile/SAML2/POST/SSO</a>" /><br> </md:IDPSSODescriptor><br><br></md:EntityDescriptor><br><br>--8<--<br>metadata/spring-demo-sp-metadata.xml<br><br><?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp" target="_blank">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>"><br> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br> <md:KeyDescriptor use="signing"><br> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br> <ds:X509Data><br> <ds:X509Certificate>MIICyzCCAbOgAwIBAgIIdt2jV63MaK8wDQYJKoZIh...gi0p6JUjcJ7JcqjzIifowZGLfnryS+V8=</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:KeyDescriptor use="encryption"><br> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br> <ds:X509Data><br> <ds:X509Certificate>MIIC1DCCAbygAwIBAgIJANjaIWSWABK4MA0GCSqGS...XSPetfJwEk6YwGd/7bKr+OvyPieI+wdnDpopu1s=</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><br><br> <md:AssertionConsumerService<br> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br> Location="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp" target="_blank">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>"<br> index="1"><br> <md:RequestedAttribute<br> FriendlyName="sAMAccountName"<br> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"<br> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br> isRequired="true"/><br> </md:AssertionConsumerService><br><br> </md:SPSSODescriptor><br></md:EntityDescriptor><br><br>--8<--<br>SAMLResponse2-2025-07-11.xml<br></span><div><span style="font-family:monospace"><br></span></div><div><span style="font-family:monospace"><?xml version="1.0" encoding="UTF-8"?><br><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp" target="_blank">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>" ID="_9e1f27825240a708581c70779cec7cd6" InResponseTo="ARQ1c627e5-a34c-47ed-948e-9e8c446992c3" IssueInstant="2025-07-12T00:07:11.077Z" Version="2.0"><br> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://idp.tech.corp:8443/idp/shibboleth" target="_blank">https://idp.tech.corp:8443/idp/shibboleth</a></saml2:Issuer><br> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br> <ds:SignedInfo><br> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" target="_blank">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/><br> <ds:Reference URI="#_9e1f27825240a708581c70779cec7cd6"><br> <ds:Transforms><br> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><br> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br> </ds:Transforms><br> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" target="_blank">http://www.w3.org/2001/04/xmlenc#sha256</a>"/><br> <ds:DigestValue>2wU/s6uTZ4Rax0O3Rzx796cWMmJ4a7qEHIbkw13hiZo=</ds:DigestValue><br> </ds:Reference><br> </ds:SignedInfo><br> <ds:SignatureValue>yorLtaG9F49Hw6ccANyw17u...kkZ29SzFyZc0ubtfN0tkmRcO</ds:SignatureValue><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate>MIIEKzCCApOgAwIBA...SMa+449/0VbjCiNsx6f/mBhDD3y2</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </ds:Signature><br> <saml2p:Status><br> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/><br> </saml2p:Status><br> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_60f532e09214bd3f82cc0109a2abae5f" IssueInstant="2025-07-12T00:07:11.077Z" Version="2.0"><br> <saml2:Issuer><a href="https://idp.tech.corp:8443/idp/shibboleth" target="_blank">https://idp.tech.corp:8443/idp/shibboleth</a></saml2:Issuer><br> <saml2:Subject><br> <saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp.tech.corp:8443/idp/shibboleth" target="_blank">https://idp.tech.corp:8443/idp/shibboleth</a>" SPNameQualifier="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp" target="_blank">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>">AAdzZWNyZXQxLdnracfAlkyoJKq...CYC9pyCRInysvGAWVXNzmyClcI</saml2:NameID><br> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br> <saml2:SubjectConfirmationData Address="10.15.15.11" InResponseTo="ARQ1c627e5-a34c-47ed-948e-9e8c446992c3" NotOnOrAfter="2025-07-12T00:12:11.100Z" Recipient="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp" target="_blank">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>"/><br> </saml2:SubjectConfirmation><br> </saml2:Subject><br> <saml2:Conditions NotBefore="2025-07-12T00:07:11.077Z" NotOnOrAfter="2025-07-12T00:12:11.077Z"><br> <saml2:AudienceRestriction><br> <saml2:Audience><a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp" target="_blank">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a></saml2:Audience><br> </saml2:AudienceRestriction><br> </saml2:Conditions><br> <saml2:AuthnStatement AuthnInstant="2025-07-12T00:07:11.002Z" SessionIndex="_750b52ba65d75304840dd91ed89d78a7"><br> <saml2:SubjectLocality Address="10.15.15.11"/><br> <saml2:AuthnContext><br> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><br> </saml2:AuthnContext><br> </saml2:AuthnStatement><br> </saml2:Assertion><br></saml2p:Response></span><br></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Michael B Allen<br>Java AD DS Integration<br><a href="http://www.ioplex.com/" target="_blank">https://www.ioplex.com/</a></div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>