no NameID in an unsolicited SAML2 Response

[Tom Scavo]

On Thu, Aug 15, 2013 at 4:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> BTW, Nate mentioned the other day, accurately, that usually an audience
> mismatch happens when the IdP thinks an endpoint is owned by entity Foo
> but the SP running there calls itself Bar. That mismatch is what leads to
> the audience error.

Okay, so we investigated further and discovered the SP was mistakenly
configured to go by two names. In fact, there are two entity
descriptors in metadata with the same endpoint location.

> In an unsolicited flow, the only identity the IdP gets of the SP is what
> you give it in the query string, so there's no guarantee the name of that
> SP is accurate in terms of having it come from an actual SP making a
> request.

I gave the IdP the other SP name (via the unsolicited protocol string)
and that did the trick. Apparently the SP doesn't recognize itself as
having the other name.

Live and learn.

Thanks,

Tom