R: different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 1/22/13 5:04 AM, "Rowan Truscott" <rowan at truscott.net.au> wrote:

>Not sure why no one has picked this up but I think the issue
>is that the SAML Request for the active client is using the
>transient NameID format. A transient name ID is usually only
>valid for the life of the session. Hence the _99... NameID below.

That's a SAML response, not a SAML request. The issue isn't that it's a
transient, it's why it's a transient, and the reason for that is as
stated, two different principal names in two different cases for the same
user and a resolver setup that doesn't accommodate that.

-- Scott