Hi, Now SAML authentication passes through asimba proxy, but i still get and error after the authentication with the IdP. I get a page with the following message: `opensaml::FatalProfileException The system encountered an error at Mon Feb 16 12:01:51 2015 To report this problem, please contact the site administrator at root@localhost. Please include the following message in any email: opensaml::FatalProfileException at (https://newton.aduneo.com/Shibboleth.sso/SAML2/POST) SAML response contained an error. Error from identity provider: Status: urn:oasis:names:tc:SAML:2.0:status:Responder Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed` And here are the logs in idp-process.log: `11:00:31.247 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:117] - Attempting to retrieve IdP session cookie. 11:00:31.247 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user admin 11:00:31.387 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178] - Successfully authenticated user admin 11:00:31.388 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine 11:00:31.388 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:349] - Looking up LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.388 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:355] - Retrieved LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.389 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request 11:00:31.389 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:349] - Looking up LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.390 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:355] - Retrieved LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.390 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process 11:00:31.390 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully 11:00:31.390 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] - Updating session information for principal admin 11:00:31.391 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700] - Creating shibboleth session for principal admin 11:00:31.391 - TRACE [edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl:98] - Created session 2ad1867da9ad8356fb8adfbbca6647325d0a8ab575fb3765f3dbfce0c83db66b 11:00:31.392 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:815] - Adding IdP session cookie to HTTP response 11:00:31.392 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:715] - Recording authentication and service information in Shibboleth session for principal: admin 11:00:31.393 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560] - User admin authenticated with method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 11:00:31.393 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] - Returning control to profile handler 11:00:31.393 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:349] - Looking up LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.394 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:355] - Retrieved LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.394 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:177] - Redirecting user to profile handler at https://alaska.aduneo.com:443/idp/profile/SAML2/POST/SSO 11:00:31.414 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:117] - Attempting to retrieve IdP session cookie. 11:00:31.414 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:123] - Found IdP session cookie. 11:00:31.415 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:81] - Updating IdP session activity time and adding session object to the request 11:00:31.415 - INFO [Shibboleth-Access:73] - 20150216T110031Z|192.168.253.15|alaska.aduneo.com:443|/profile/SAML2/POST/SSO| 11:00:31.416 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/POST/SSO 11:00:31.416 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler 11:00:31.416 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:349] - Looking up LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.417 - TRACE [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:355] - Retrieved LoginContext with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518 from StorageService parition: loginContexts 11:00:31.417 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:588] - Unbinding LoginContext 11:00:31.417 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:614] - Expiring LoginContext cookie 11:00:31.418 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:625] - Removed LoginContext, with key a846dc922ce833a3eb9b40a7b72ca743643c68cff9d94cea2560e11c7b29b518, from StorageService partition loginContexts 11:00:31.418 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:172] - Incoming request contains a login context and indicates principal was authenticated, processing second leg of request 11:00:31.418 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for https://alaska.aduneo.com/asimba/profiles/saml2 11:00:31.419 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:130] - Custom relying party configuration found for https://alaska.aduneo.com/asimba/profiles/saml2 11:00:31.421 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:478] - Resolving attributes for principal 'admin' for SAML request from relying party 'https://alaska.aduneo.com/asimba/profiles/saml2' 11:00:31.421 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:119] - shibboleth.AttributeResolver resolving attributes for principal admin 11:00:31.421 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal admin were not requested, resolving all attributes. 11:00:31.422 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute uid for principal admin 11:00:31.422 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector siteLDAP for principal admin 11:00:31.422 - TRACE [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.TemplateEngine:119] - Populating velocity context 11:00:31.423 - TRACE [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.TemplateEngine:93] - Populating the following shibboleth.resolver.dc.siteLDAP template 11:00:31.424 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (|(uid=admin)(mail=admin)) 11:00:31.425 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - LDAP data connector siteLDAP - Retrieving attributes from LDAP 11:00:31.485 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: uid[admin] 11:00:31.485 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: sn[User] 11:00:31.486 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: inum[@!00EB.2A19.32E4.4E23!0001!5A40.2DD3!0000!A8F2.DE1E.D7FB] 11:00:31.486 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: gluuStatus[active] 11:00:31.486 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: oxLastLogonTime[20150216085527.332Z] 11:00:31.487 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: userPassword[e1NTSEF9ZTBYWjBORTNEMm1XR0ZlL2Z5VTJmWEZqQ2oxQmk2YUg=] 11:00:31.487 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: entryDN[inum=@!00EB.2A19.32E4.4E23!0001!5A40.2DD3!0000!A8F2.DE1E.D7FB,ou=people,o=@!00EB.2A19.32E4.4E23!0001!5A40.2DD3,o=gluu] 11:00:31.487 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: objectClass[ox-00EB2A1932E44E2300015A402DD3, gluuPerson, top] 11:00:31.488 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: givenName[Admin] 11:00:31.488 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: memberOf[inum=@!00EB.2A19.32E4.4E23!0001!5A40.2DD3!0003!60B7,ou=groups,o=@!00EB.2A19.32E4.4E23!0001!5A40.2DD3,o=gluu] 11:00:31.489 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector siteLDAP - Found the following attribute: displayName[Default Admin User] 11:00:31.489 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute uid containing 1 values 11:00:31.489 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal admin 11:00:31.490 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:97] - Building transient ID for request _cf3daba24f97faa7d3a69a1810e3ee6cq3tzJa3zHwYEXENLvCyZhw; outbound message issuer: https://alaska.aduneo.com/idp/shibboleth, inbound message issuer: https://alaska.aduneo.com/asimba/profiles/saml2, principal identifer: admin 11:00:31.490 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:115] - Created transient ID _565398f243440e7994266cd6d168139f for request _cf3daba24f97faa7d3a69a1810e3ee6cq3tzJa3zHwYEXENLvCyZhw 11:00:31.490 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute transientId containing 1 values 11:00:31.491 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:473] - Attribute uid has 1 values after post-processing 11:00:31.491 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:473] - Attribute transientId has 1 values after post-processing 11:00:31.491 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:137] - shibboleth.AttributeResolver resolved, for principal admin, the attributes: [uid, transientId] 11:00:31.492 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:71] - shibboleth.AttributeFilterEngine filtering 2 attributes for principal admin 11:00:31.492 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy SiteApp1 is active for principal admin 11:00:31.492 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:139] - Filter policy SiteApp1 is active for principal admin 11:00:31.493 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute uid for principal admin 11:00:31.493 - TRACE [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:174] - The following value for attribute uid meets the permit value rule: admin 11:00:31.493 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy SiteApp2 is active for principal admin 11:00:31.494 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:134] - Filter policy SiteApp2 is not active for principal admin 11:00:31.494 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy SiteApp3 is active for principal admin 11:00:31.494 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:134] - Filter policy SiteApp3 is not active for principal admin 11:00:31.495 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109] - Attribute uid has 1 values after filtering 11:00:31.495 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:106] - Removing attribute from return set, no more values: transientId 11:00:31.495 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114] - Filtered attributes for principal admin. The following attributes remain: [uid] 11:00:31.496 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:505] - Creating attribute statement in response to SAML request '_cf3daba24f97faa7d3a69a1810e3ee6cq3tzJa3zHwYEXENLvCyZhw' from relying party 'https://alaska.aduneo.com/asimba/profiles/saml2' 11:00:31.496 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:247] - Encoded attribute uid with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder 11:00:31.497 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:527] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder 11:00:31.497 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute uid, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder 11:00:31.498 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:504] - No attributes for principal 'admin' support encoding into a supported name identifier format for relying party 'https://alaska.aduneo.com/asimba/profiles/saml2' 11:00:31.498 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:572] - Determining if SAML assertion to relying party 'https://alaska.aduneo.com/asimba/profiles/saml2' should be signed 11:00:31.498 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:653] - IdP relying party configuration 'https://alaska.aduneo.com/asimba/profiles/saml2' indicates to sign assertions: false 11:00:31.499 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:660] - Entity metadata for relying party 'https://alaska.aduneo.com/asimba/profiles/saml2 'indicates to sign assertions: false 11:00:31.499 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request _cf3daba24f97faa7d3a69a1810e3ee6cq3tzJa3zHwYEXENLvCyZhw from relying party https://alaska.aduneo.com/asimba/profiles/saml2 11:00:31.533 - INFO [Shibboleth-Audit:1028] - 20150216T110031Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_cf3daba24f97faa7d3a69a1810e3ee6cq3tzJa3zHwYEXENLvCyZhw|https://alaska.aduneo.com/asimba/profiles/saml2|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://alaska.aduneo.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_b160215d55e20d6346fde7856d0859fd|admin|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,||_59bd5c066be16a58a2be450937674999,|` NB: i am using the authentication UserPassword Method, could this be the problem? I tried to use RemoteUser authentication handler, and i get an error before the redirection to the authentication page happens. is this normal? Thank you