Shibboleth Developers

["Scott Cantor" <>]

>      <Path name="secure" requireSession="true" 
> exportAssertion="true" />

Another question I have...Are you relying on the RequestMap settings to
control the session requirements, or do you have an htaccess command
(ShibRequireSession) in Apache somewhere to force that?

What happens if you put ShibExportAssertion On in that same spot? Does IE
then show it exporting the assertion regardless?

If so, I would say that reinforces that the RequestMap process is failing on
that first page access because the scheme isn't coming back from Apache
correctly, while inline native command processing turns on those flags
directly.

-- Scott