IDP Failure

[Cantor, Scott]

On 1/15/13 10:53 AM, "Ogunleye, Philip" <Philip.Ogunleye at snapon.com> wrote:

>Forgive my naivety but I did not know that I couldn¹t use a transientID
>to send the username.

You don't send anything in a request, that's a very specialized case. The
IdP tells you who the user is after they login and it responds.

You certainly can't send a transient ID, because you don't know any. The
transient would be created after login time by the IdP and used to mask
the user identity. Yours is bogus and the IdP is failing to reverse it and
then simply gives up.

>  I am working off of an example provided by the company who will be the
>identity provider going forward.  I have setup all areas to use transient
> ids.  I simply want the value sent over to be verified in the directory
>service and reported back successfully.

That's not how SAML works. You don't verify the user's identity, you get
it in the response. Your request is to identify who you are and other
inputs to the process. You need to read the standard, basically.

> 
>However I am getting a failure response below.  I haven¹t seen any
>indication on the shibboleth wiki to tell me otherwise so assumed it was
>ok to send in this format.  I have amended the service provider to send
>the request as a WindowDomainQualifiedName
> value.  However the same response is sent back.  The name ID format in
>both the IDP and SP metadata has been modified to go in the same format
>too.  I will also amend the attribute-resolver.xml and the
>attribute-filter.xml likewise.
> 
>Please let me know what else should be changed.

I did. Stop sending a NameID in the request so the IdP doesn't have to try
and reverse it during processing.

-- Scott