R: different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 1/16/13 7:19 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>
>Scott please correct me if I'm wrong: since one full assertion is created
>for both WEB and ACTIVE clients without any errors, I assume that the
>authentication succeded, didn't it?

Yes, it succeeded.

>For this reason, I guess I should look into IDP configuration rather than
>Tomcat, shouldn't I. And in this case, where is the place where the
><saml2:NameID> element is created for ECP clients?

No.

There is nothing about ECP that has anything to do with this, or anything
to do with NameID generation. The difference is your input to the process,
or more precisely the principal name generated by the two authentication
configurations.

If you want to ignore that difference, then you are going to have to
change your resolver configuration to produce equivalent data internally
from your data sources regardless of the principal name. Whether that's
possible or not depends on your data sources.

-- Scott