no NameID in an unsolicited SAML2 Response

[Cantor, Scott]

On 8/15/13 4:10 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>A Shibboleth IdP is pushing an unsolicited SAML2 Response to a
>Shibboleth SP. The SP is reporting in the browser window that the
>"Assertion contains an unacceptable AudienceRestriction," which is not
>true. As it turns out, the IdP is not including a NameID in the
>assertion. Which endpoint is at fault here?

The SP doesn't care if a NameID is supplied or not, and it definitely
isn't related to audience behavior or checking. That error should mean
exactly that, normally due to an entityID or endpoint mismatch. Usually it
means the metadata's not accurate.

Omitting a NameID, though unrelated, is basically an attribute release
matter but NameID selection is very complicated and can involve metadata
and request settings from the SP.

What leads you to connect it to an audience issue?

-- Scott