different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 1/15/13 10:46 AM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>
>My apologies for attaching logs coming from 2 different tests with
>different users.

You didn't. Nothing has changed, and my answer is exactly what it was
yesterday. That is the problem. I don't know what else to tell you. If you
didn't understand the answer, then you'll have to explain what you didn't
understand about it.

>Here is the assertions I get when I authenticate with
>michela at shibbdomain.eduteamit.net in either WEB Mail (Internet Explorer)
>and Outlook 2013 (Active Client). Please note that both of them only ask
>the same 2 pieces of information (UPN + password), and I need to provide
>both authentication mechanism, however as far as I understood I did NOT
>configure a different filter policy or attributes set for WEB and ECP.

No, you didn't. But your authentication is not the same. One of the
authentication approaches sets the principal name to a fully-qualified
Kerberos name with a realm, and the other one didn't. That results in two
different inputs to the resolver process and that's the cause of your
problem.

-- Scott