IdP 2.1.3 to 2.3.3 SPNameQualifier error

[Christopher Bongaarts]

Upgraded my old 2.1.3 IdP in test to the latest 2.3.3.  Seems to work OK 
for Shib SPs, but for at least one provider I'm getting an error now 
when it had worked before (with identical configuration).

12:48:18.783 - DEBUG [PROTOCOL_MESSAGE:112] -
<?xml version="1.0" encoding="UTF-8"?><saml2p:AuthnRequest 
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://umntst.service-now.com/navpage.do" 
ForceAuthn="false" ID="SNC455fd069732d6abbc8cc82ff4a71a2ba" 
IsPassive="false" IssueInstant="2011-10-11T17:48:18.517Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
ProviderName="https://umntst.service-now.com/navpage.do" Version="2.0">
    <saml2:Issuer 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://umntst.service-now.com</saml2:Issuer>
    <saml2p:NameIDPolicy AllowCreate="true" 
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" 
SPNameQualifier="https://umntst.service-now.com/navpage.do"/>
    <saml2p:RequestedAuthnContext Comparison="exact">
       <saml2:AuthnContextClassRef 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>


which now results in:

    <saml2p:Status>
       <saml2p:StatusCode 
Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
          <saml2p:StatusCode 
Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
       </saml2p:StatusCode>
       <saml2p:StatusMessage>Invalid SPNameQualifier for this 
request</saml2p:StatusMessage>
    </saml2p:Status>

Any ideas?  As I said, this SP works fine in 2.1.3 with the same config.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%