<div dir="ltr"><div>I'm trying to learn SAML (from zero) so I set up a Shibboleth 5.1.4 IdP and a minimalistic spring boot SP. <br><br>It works, I'm authenticated, I get redirected back to the SP but ... I can't get attribute release working.</div><div><br></div><div>The SAMLResponse has no AttributeStatement (see very bottom of message for SAMLResponse.xml).</div><div><br></div><div>I understand the basic export then filter but I'm blurry on how it all should be used in practice.<br></div><div><br>Maybe someone can spot the failure?<br><br>Clearly Shibboleth is targeting the University / Research community but I work more with the Enterprise crowd.<br><br>So I'm using the KerberosValidator and LDAPConnector with Active Directory (confirmed in WireShark decrypted with sslkeylog LDAP search is working) and trying to release the sAMAccountName as an attribute.</div><div><br>The docs gave me the impression that I just needed to do exportAttributes="sAMAccountName" and <AttributeRule attributeID="sAMAccountName" permitAny="true"/> but there is simply no AttributeStatement in the SAMLResponse.<br><br>I thought maybe the SP needed to explicitly request with RequestedAttribute so I manually added it to the sp metadata but that had no effect.<br><br>Output of aacli shows no error but nothing interesting:<br><span style="font-family:monospace"><br>$ bin/aacli.sh -n dev@TECH.CORP -r '<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>'<br>(<a href="https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP">https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP</a>) <a href="https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP">https://idp.tech.corp:8443/profile/admin/resolvertest?requester=http%3A%2F%2Fsp.techi.wan%3A8080%2Fsaml2%2Fservice-provider-metadata%2Ftechcorp&principal=dev%40TECH.CORP</a></span><br><br>Again, I'm a total SAML newb so any general guidance about good Shibboleth practices (particularly in an Enterprise environment) would be greatly appreciated.<br><br>Below are various files that I *think* are important but heavily trimmed for reasonable email consumption.<br><br>Can anyone recommend diagnostics?<br><br>Mike<br><br><span style="font-family:monospace">--8<--<br>conf/idp.properties<br><br>idp.entityID=<a href="https://idp.tech.corp:8443/idp/shibboleth">https://idp.tech.corp:8443/idp/shibboleth</a><br>idp.scope=tech.corp<br><br>--8<--<br>conf/services.properties<br><br>idp.service.relyingparty.ignoreUnmappedEntityAttributes=true<br><br>idp.service.attribute.registry.checkInterval = PT15M<br>idp.service.attribute.registry.encodeType = false<br>idp.service.attribute.resolver.checkInterval = PT15M<br>idp.service.attribute.filter.checkInterval = PT15M<br><br>--8<--</span></div><div><span style="font-family:monospace">conf/metadata-providers.xml<br><br>    <MetadataProvider id="LocalMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/spring-demo-sp-metadata.xml"/><br><br>--8<--<br>conf/relying-party.xml<br><br>    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"><br>        <property name="profileConfigurations"><br>            <list><br>                <ref bean="SAML2.SSO" /><br>                <ref bean="SAML2.ECP" /><br>                <ref bean="SAML2.Logout" /><br>                <!--<br>                <ref bean="SAML2.AttributeQuery" /><br>                --><br>                <ref bean="SAML2.ArtifactResolution" /><br>            </list><br>        </property><br>    </bean><br><br>    <util:list id="shibboleth.RelyingPartyOverrides"><br>        <bean id="ExampleSP" parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>"><br>            <property name="profileConfigurations"><br>                <list><br>                    <bean parent="SAML2.SSO" p:encryptAssertions="false" /><br>                </list><br>            </property><br>        </bean><br>    </util:list><br><br>--8<--<br>conf/saml-nameid.xml<br><br>    <util:list id="shibboleth.SAML2NameIDGenerators"><br>        <ref bean="shibboleth.SAML2TransientGenerator" /><br>    </util:list><br><br>--8<--<br>conf/services.xml<br></span></div><span style="font-family:monospace">    <util:list id="shibboleth.RelyingPartyResolverResources"><br>        <value>%{idp.home}/conf/relying-party.xml</value><br>        <value>%{idp.home}/conf/credentials.xml</value><br>    </util:list><br><br>    <util:list id="shibboleth.MetadataResolverResources"><br>        <value>%{idp.home}/conf/metadata-providers.xml</value><br>    </util:list><br><br>    <util:list id ="shibboleth.AttributeResolverResources"><br>        <value>%{idp.home}/conf/attribute-resolver.xml</value><br>    </util:list><br><br>    <util:list id ="shibboleth.AttributeRegistryResources"><br>        <value>%{idp.home}/conf/attribute-registry.xml</value><br>        <value>%{idp.home}/conf/attributes/default-rules.xml</value><br>        <value>%{idp.home}/conf/attribute-resolver.xml</value><br>    </util:list><br><br>    <util:list id ="shibboleth.AttributeFilterResources"><br>        <value>%{idp.home}/conf/attribute-filter.xml</value><br>    </util:list><br><br>    <util:list id ="shibboleth.NameIdentifierGenerationResources"><br>        <value>%{idp.home}/conf/saml-nameid.xml</value><br>    </util:list><br><br>    <util:list id="shibboleth.AccessControlResources"><br>        <value>%{idp.home}/conf/access-control.xml</value><br>    </util:list><br><br>--8<--<br>conf/attribute-registry.xml<br><br>    <bean parent="shibboleth.TranscodingRuleLoader"<br>        c:dir="%{idp.home}/conf/attributes/custom"<br>        c:extensions="#{{'.txt', '.props', '.properties', '.rule'}}" /><br><br>--8<--<br>conf/attribute-resolver.xml<br><br>    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br>        principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br>        startTLSTimeout="%{idp.attribute.resolver.LDAP.startTLSTimeout}"<br>        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br>        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br>        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"<br>        connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"<br>        noResultIsError="true"<br>        multipleResultsIsError="true"<br>        excludeResolutionPhases="c14n/attribute"<br>        exportAttributes="sAMAccountName mail displayName sn givenName departmentNumber employeeNumber eduPersonEntitlement eduPersonAssurance"><br>        <FilterTemplate><br>            <![CDATA[<br>                %{idp.attribute.resolver.LDAP.searchFilter}<br>            ]]><br>        </FilterTemplate><br>        <ConnectionPool<br>            minPoolSize="%{idp.pool.LDAP.minSize:3}"<br>            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br>            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br>            validateDN="%{idp.pool.LDAP.validateDN:}"<br>            validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"<br>            validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"<br>            prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"<br>            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/><br>    </DataConnector><br><br>--8<--<br>conf/attribute-filter.xml<br><br>    <AttributeFilterPolicy id="alwaysRelease"><br>        <PolicyRequirementRule xsi:type="ANY" /><br><br>        <AttributeRule attributeID="sAMAccountName" permitAny="true" /><br>    </AttributeFilterPolicy><br><br>    <AttributeFilterPolicy id="Per-Attribute-singleValued"><br>        <PolicyRequirementRule xsi:type="ANY" /><br><br>        <AttributeRule attributeID="eduPersonPrincipalName"><br>            <PermitValueRule xsi:type="EntityAttributeExactMatch"<br>                attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br>                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                attributeValue="eduPersonPrincipalName" /><br>        </AttributeRule><br>        <AttributeRule attributeID="mail"><br>            <PermitValueRule xsi:type="EntityAttributeExactMatch"<br>                attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br>                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                attributeValue="mail" /><br>        </AttributeRule><br>    </AttributeFilterPolicy><br><br>    <AttributeFilterPolicy id="Per-Attribute-Affiliation"><br>        <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"<br>            attributeName="<a href="http://shibboleth.net/ns/attributes/releaseAllValues">http://shibboleth.net/ns/attributes/releaseAllValues</a>"<br>            attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>            attributeValue="eduPersonScopedAffiliation" /><br><br>        <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" /><br>    </AttributeFilterPolicy><br><br>    <AttributeFilterPolicy id="subject-identifiers"><br>        <PolicyRequirementRule xsi:type="ANY" /><br><br>        <AttributeRule attributeID="samlPairwiseID"><br>            <PermitValueRule xsi:type="OR"><br>                <Rule xsi:type="EntityAttributeExactMatch"<br>                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br>                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                    attributeValue="pairwise-id" /><br>                <Rule xsi:type="EntityAttributeExactMatch"<br>                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br>                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                    attributeValue="any" /><br>            </PermitValueRule><br>        </AttributeRule><br><br>        <AttributeRule attributeID="samlSubjectID"><br>            <PermitValueRule xsi:type="EntityAttributeExactMatch"<br>                attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"<br>                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                attributeValue="subject-id" /><br>        </AttributeRule><br>    </AttributeFilterPolicy><br><br>    <AttributeFilterPolicy id="example1"><br>        <PolicyRequirementRule xsi:type="Requester" value="<a href="https://sp.example.org">https://sp.example.org</a>" /><br><br>        <AttributeRule attributeID="uid" permitAny="true" /><br>    </AttributeFilterPolicy><br><br>    <AttributeFilterPolicy id="example2"><br>        <PolicyRequirementRule xsi:type="OR"><br>            <Rule xsi:type="Requester" value="<a href="https://sp.example.org">https://sp.example.org</a>" /><br>            <Rule xsi:type="Requester" value="<a href="https://another.example.org/shibboleth">https://another.example.org/shibboleth</a>" /><br>        </PolicyRequirementRule><br>        <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" /><br>    </AttributeFilterPolicy><br><br>--8<--<br>metadata/idp-metadata.xml<br><br><md:EntityDescriptor entityID="<a href="https://idp.tech.corp:8443/idp/shibboleth">https://idp.tech.corp:8443/idp/shibboleth</a>" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>        <md:Extensions><br>            <shibmd:Scope regexp="false">tech.corp</shibmd:Scope><br>            <mdui:UIInfo><br>                <mdui:DisplayName xml:lang="en">A name for the IdP at idp.tech.corp</mdui:DisplayName><br>                <mdui:Description xml:lang="en">Enter a description for the IdP at idp.tech.corp</mdui:Description><br>                <mdui:Logo xml:lang="en" width="80" height="80"><a href="https://idp.tech.corp:8443/path/to/logo.png">https://idp.tech.corp:8443/path/to/logo.png</a></mdui:Logo><br>            </mdui:UIInfo><br>        </md:Extensions><br>        <md:KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                <ds:X509Data><br>                    <ds:X509Certificate><br>MIIELDCCApSgAwIBAgIVAK484vuVe9lKp/8o/7eobxivCsMMMA0GCSqGSIb3DQEBCwUAMBsxGTAX<br>...<br>RUNnmUC5BXD2Z1RtTousKNzX2d2q5LGzej8heIF7mXmqZhEccG8Eib0h6Nk0XQ==<br>                    </ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                <ds:X509Data><br>                    <ds:X509Certificate><br>MIIEKzCCApOgAwIBAgIUL6IhHqoVAEx3htbU+AB8F8KQeXowDQYJKoZIhvcNAQELBQAwGzEZMBcG<br>...<br>v3Q0iVZWuNVwsWCyZ1FGTpUcraXGR/s3SMa+449/0VbjCiNsx6f/mBhDD3y2<br>                    </ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:KeyDescriptor use="encryption"><br>            <ds:KeyInfo><br>                <ds:X509Data><br>                    <ds:X509Certificate><br>MIIEKzCCApOgAwIBAgIUUyTDN5iEAgu/crWPHUJvAiuXuzEwDQYJKoZIhvcNAQELBQAwGzEZMBcG<br>...<br>ZmpOy1+Qvfc1RXuUpJc/qpxfjAKDuxWZnveE0EHIqt4Sogb1CZyJ732m0ste<br>                    </ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/SOAP/ArtifactResolution">https://idp.tech.corp:8443/idp/profile/SAML2/SOAP/ArtifactResolution</a>" /><br>        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/POST-SimpleSign/SSO">https://idp.tech.corp:8443/idp/profile/SAML2/POST-SimpleSign/SSO</a>" /><br>        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/Redirect/SSO">https://idp.tech.corp:8443/idp/profile/SAML2/Redirect/SSO</a>" /><br>        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://idp.tech.corp:8443/idp/profile/SAML2/POST/SSO">https://idp.tech.corp:8443/idp/profile/SAML2/POST/SSO</a>" /><br>    </md:IDPSSODescriptor><br><br></md:EntityDescriptor><br><br>--8<--<br>metadata/spring-demo-sp-metadata.xml<br><br><?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>"><br>    <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>        <md:KeyDescriptor use="signing"><br>            <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>                <ds:X509Data><br>                    <ds:X509Certificate>MIICyzCCAbOgAwIBAgIIdt2jV63MaK8wDQYJKoZIh...gi0p6JUjcJ7JcqjzIifowZGLfnryS+V8=</ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:KeyDescriptor use="encryption"><br>            <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>                <ds:X509Data><br>                    <ds:X509Certificate>MIIC1DCCAbygAwIBAgIJANjaIWSWABK4MA0GCSqGS...XSPetfJwEk6YwGd/7bKr+OvyPieI+wdnDpopu1s=</ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><br><br>        <md:AssertionConsumerService<br>                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>                Location="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>"<br>                index="1"><br>            <md:RequestedAttribute<br>                    FriendlyName="sAMAccountName"<br>                    Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"<br>                    NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>                    isRequired="true"/><br>        </md:AssertionConsumerService><br><br>    </md:SPSSODescriptor><br></md:EntityDescriptor><br><br>--8<--<br>SAMLResponse2-2025-07-11.xml<br></span><div><span style="font-family:monospace"><br></span></div><div><span style="font-family:monospace"><?xml version="1.0" encoding="UTF-8"?><br><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>" ID="_9e1f27825240a708581c70779cec7cd6" InResponseTo="ARQ1c627e5-a34c-47ed-948e-9e8c446992c3" IssueInstant="2025-07-12T00:07:11.077Z" Version="2.0"><br>  <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://idp.tech.corp:8443/idp/shibboleth">https://idp.tech.corp:8443/idp/shibboleth</a></saml2:Issuer><br>  <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>    <ds:SignedInfo><br>      <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>      <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/><br>      <ds:Reference URI="#_9e1f27825240a708581c70779cec7cd6"><br>        <ds:Transforms><br>          <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><br>          <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>        </ds:Transforms><br>        <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>"/><br>        <ds:DigestValue>2wU/s6uTZ4Rax0O3Rzx796cWMmJ4a7qEHIbkw13hiZo=</ds:DigestValue><br>      </ds:Reference><br>    </ds:SignedInfo><br>    <ds:SignatureValue>yorLtaG9F49Hw6ccANyw17u...kkZ29SzFyZc0ubtfN0tkmRcO</ds:SignatureValue><br>    <ds:KeyInfo><br>      <ds:X509Data><br>        <ds:X509Certificate>MIIEKzCCApOgAwIBA...SMa+449/0VbjCiNsx6f/mBhDD3y2</ds:X509Certificate><br>      </ds:X509Data><br>    </ds:KeyInfo><br>  </ds:Signature><br>  <saml2p:Status><br>    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/><br>  </saml2p:Status><br>  <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_60f532e09214bd3f82cc0109a2abae5f" IssueInstant="2025-07-12T00:07:11.077Z" Version="2.0"><br>    <saml2:Issuer><a href="https://idp.tech.corp:8443/idp/shibboleth">https://idp.tech.corp:8443/idp/shibboleth</a></saml2:Issuer><br>    <saml2:Subject><br>      <saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp.tech.corp:8443/idp/shibboleth">https://idp.tech.corp:8443/idp/shibboleth</a>" SPNameQualifier="<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>">AAdzZWNyZXQxLdnracfAlkyoJKq...CYC9pyCRInysvGAWVXNzmyClcI</saml2:NameID><br>      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br>        <saml2:SubjectConfirmationData Address="10.15.15.11" InResponseTo="ARQ1c627e5-a34c-47ed-948e-9e8c446992c3" NotOnOrAfter="2025-07-12T00:12:11.100Z" Recipient="<a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a>"/><br>      </saml2:SubjectConfirmation><br>    </saml2:Subject><br>    <saml2:Conditions NotBefore="2025-07-12T00:07:11.077Z" NotOnOrAfter="2025-07-12T00:12:11.077Z"><br>      <saml2:AudienceRestriction><br>        <saml2:Audience><a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a></saml2:Audience><br>      </saml2:AudienceRestriction><br>    </saml2:Conditions><br>    <saml2:AuthnStatement AuthnInstant="2025-07-12T00:07:11.002Z" SessionIndex="_750b52ba65d75304840dd91ed89d78a7"><br>      <saml2:SubjectLocality Address="10.15.15.11"/><br>      <saml2:AuthnContext><br>        <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><br>      </saml2:AuthnContext><br>    </saml2:AuthnStatement><br>  </saml2:Assertion><br></saml2p:Response></span><br></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Michael B Allen<br>Java AD DS Integration<br><a href="http://www.ioplex.com/" target="_blank">https://www.ioplex.com/</a></div></div></div>