we've ran into two odd issues when testing a Shibboleth implementation, but I'm not sure if they are related. AQRs are setup so users are not cached, we noticed that a user without content only show on a search head the load balancer has sent them to and therefore content cannot be assigned to them unless they've accessed all the search heads. along the content line, replicate certificates does not do what it says. it does not replicate the idp cert across the search heads, but as soon as that was enabled does content, users, and saml groups replicate peer-to-peer. I assume we have an incorrect setting in place, but any help is very much appreciated! ... View more