<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Ravi,<div><br></div><div>Passive authentication is a different feature of SAML 2.0; it allows the SP to send an AuthnRequest to the IdP that includes the isPassive="true" flag. This flag means the IdP should send an assertion if the user is already authenticated, but if the user is not authenticated, the IdP must not interact with the user and must send the user back to the SP with no assertion. The general term for authenticating the user when the application requests it, but not before that, is "lazy authentication".</div><div><br></div><div>I think that checkbox is for passive authentication as described in the specifications and it should be unrelated to this issue. However, one of the developers might be able to correct me.</div><div><br></div><div>Take care, and thanks for your use of Shibboleth and shib_auth,</div><div>Nate.</div><div><br><div><div>On Jun 5, 2012, at 20:57 , Ravi Verma wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">In addition I also needed to make sure that the box "Enable passive authentication" on Advance Setting tab of Shib Auth was not checked. I had it checked by mistake and took 30 minutes to debug.</span></blockquote></div><br></div></body></html>