different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 1/15/13 12:11 PM, "Ryan Suarez" <ryan.suarez at sheridancollege.ca> wrote:
>The other is that Office 365 requires ImmutableID (which is objectGUID in
>your case) to be passed as the NameID.  Your web auth is passing the
>correct one, but your active auth is not.

I'm sure that's probably a consequence of the mismatched principal names.
The unqualified ID it's passing to the IdP is failing to work in the
resolver to lookup the data that results in the ImmutableID in the
assertion, so it's probably one problem.

Whatever is being used for authentication ultimately isn't the IdP, so
whatever it is, JAAS or otherwise, that is the documentation to refer to
on how it generates the resulting principal names.

-- Scott