<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Actually, if the shib_auth module always issues a passive authentication request on initial access when "Enable passive authentication" is checked, which would make sense, and your IdP didn't support the isPassive="true" flag, then that could definitely cause the symptoms you describe. I'm glad you thought of it and disabled that checkbox.<div><br><div><div>On Jun 5, 2012, at 21:24 , Nate Klingenstein wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">I think that checkbox is for passive authentication as described in the specifications and it should be unrelated to this issue. However, one of the developers might be able to correct me.</span></blockquote></div><br></div></body></html>