(Slightly) different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 4/18/13 12:00 PM, "Glenn Wearen" <glenn.wearen at heanet.ie> wrote:
>
>Maybe somebody can spot an important difference in two responses being
>sent to Office365, web browser access is working, Outlook client is not.

The active response is missing that SPNameQualifier, but I don't know why.
If that's not causing the issue, then you'll have to ask Microsoft. If it
is, that's a bug because in this context SPNameQualifier should be
defaulted in at the RP end as the value of the requesting SP, which you
can see is in the Audience. So in SAML terms they are the same.

As far as working around such a bug, I don't know why it would be
different, that code ought to be the same for both ECP and SSO. In fact I
kind of know it is. So that would take deeper investigation. Logging on
debug might give me a clue.

-- Scott