Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

[Pete Scott]

Greetings,

Quick environment primer: We run hosted applications on Windows servers with SP installed, providing optional integration with client IdPs.

We're having another client integration with issues.

After the user enters their credentials (note that a (basic auth?) dialog box is presented upon navigating to the IdP), they are directed back to our SP and presented with the following error.

opensaml::FatalProfileException at (https://staging-xxx.xxxxxxxx.com/xxxxxx/Shibboleth.sso/SAML2/POST)
SAML response contained an error
Error from identity provider:
    Status: urn:oasis:names:tc:SAML:2.0:status:Responder
    Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
	
The client sent us this:
The error your side is presenting is typical of an SP that's misconfigured in one of the following ways:
- It's looking for a  specific AuthnContextClass, specifically PasswordProtectedTransport
- The username is expected in the subject instead of the AttributeStatement
- Uid isn't set as the attribute to use for REMOTE_USER

Thoughts? I can provide more data if asked for it, though I'm hesitant to provide specifics about the client's environment.

--
Pete Scott