<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Hello,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>I was hoping to get a better understanding of the following error and how to address it. After being directed back to our SP (which is running Shibboleth) from the customer’s IdP, the user sees an error message:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>opensaml::FatalProfileException at (https://server-running-shibboleth-sp.com/Shibboleth.sso/SAML2/POST)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>An Issuer was supplied that conflicts with previous results.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>The shibd.log file (with debug logging enabled) looks like:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]: message from (http://customer-idp-site.com/metadata)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]: searching metadata for message issuer...<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]: no request/response correlation cookie found<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1] [default]: evaluating message flow policy (correlation off, replay checking on, expiration 60)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1] [default]: ignoring InResponseTo, correlation checking is disabled<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.StorageService [1] [default]: inserted record (id-13d8a44f44ab5d8eb2490eca8610b65ccbdd5de8) in context (MessageFlow) with expiration (1767795439)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1] [default]: validating signature profile<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolving ds:X509Certificate<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolved 1 certificate(s)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolved 0 CRL(s)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.TrustEngine.ExplicitKey [1] [default]: attempting to validate signature with the peer's credentials<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG XMLTooling.TrustEngine.ExplicitKey [1] [default]: signature validated with credential<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1] [default]: signature verified against message issuer<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG Shibboleth.SSO.SAML2 [1] [default]: processing message against SAML 2.0 SSO profile<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 DEBUG Shibboleth.SSO.SAML2 [1] [default]: extracting issuer from SAML 2.0 assertion<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 WARN Shibboleth.SSO.SAML2 [1] [default]: detected a problem with assertion: An Issuer was supplied that conflicts with previous results.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2026-01-07 08:13:20 WARN Shibboleth.SSO.SAML2 [1] [default]: error processing incoming assertion: An Issuer was supplied that conflicts with previous results.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>I also have a .har file captured, SAML Tracer output logs, and configuration xml files saved to better inspect the http response if that is helpful.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal>-David<br><br><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>