InvalidNameIDPolicy working with ADFS

saml saml-2.0 adfs claims
wcpaez picture wcpaez · Nov 11, 2016 · Viewed 17.4k times · Source

I have many clients that uses SSO, for that we use SAML 2. Many of my clients uses providers like Okta, PingIdentity and a bunch of them ADFS. Doing the integration with ADFS always at the beginning raises this error when they came back with the SAMLResponse.

<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></samlp:StatusCode></samlp:Status>

Im asking to use as name Identifier this:

"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

Im pretty new to SAML and I just want to know what is happening on ADFS, since this is just happening with clients that uses that.

Thanks a lot.

Answer

Sam picture Sam · Nov 11, 2016

By default, ADFS sends the NameId format as "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified". You can adjust it. See: https://social.technet.microsoft.com/wiki/contents/articles/4038.ad-fs-2-0-how-to-request-a-specific-name-id-format-from-a-claims-provider-cp-during-saml-2-0-single-sign-on-sso.aspx

Related questions

What is the correct format for SAML 2.0 Assertions?

We have a customer trying to use ADFS to SSO on to our web application. We are using the ComponentSpace SAML 2.0 library. The assertion being sent to us looks like: <Assertion ID="_b8a24809-ab6b-4acd-ad6a-8bcb97…

Read More
SAML LogOutRequest processing failed on ADFS server

I have ADFS server as an IdP. I have separate SP application. These are defined in circle of trust. SSO over SAML protocol is working fine. When I try SP initated log out request I got error on ADFS side : …

Read More
Working with SAML 2.0 in C# .NET 4.5

I am trying to use pure .NET (no external classes, controls, helpers) to create a SAML message. I found some code on the interwebs; this is what I have: private static SamlAssertion createSamlAssertion() { // Here we create some SAML assertion with …

Read More