R: different assertions generated for WEB and ACTIVE clients

[Mauro Minella]

>> That's Tomcat. If their documentation isn't sufficient, I'd suggest checking with them on the behavior of that code. If you want to avoid the problem, I suggest switching to the JAAS Realm, because that can reuse the same configuration as the IdP can use. That guarantees consistency. In short, that's the reason you're having the problem.

Scott please correct me if I'm wrong: since one full assertion is created for both WEB and ACTIVE clients without any errors, I assume that the authentication succeded, didn't it? The point is that the WEB clients I get

<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">WcwzuD50xEmCH3xsfbbeEA==</saml2:NameID>

, while the ACTIVE clients receive

<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth">_9955833da857f2fa2b7915bd24982e18</saml2:NameID>

For this reason, I guess I should look into IDP configuration rather than Tomcat, shouldn't I. And in this case, where is the place where the <saml2:NameID> element is created for ECP clients?

Thanks

Mauro