Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

[Cantor, Scott]

On 6/25/13 10:58 AM, "Pete Scott" <PScott at t2systems.com> wrote:

>The client sent us this:
>The error your side is presenting is typical of an SP that's
>misconfigured in one of the following ways:
>- It's looking for a  specific AuthnContextClass, specifically
>PasswordProtectedTransport
>- The username is expected in the subject instead of the
>AttributeStatement
>- Uid isn't set as the attribute to use for REMOTE_USER
>
>Thoughts? I can provide more data if asked for it, though I'm hesitant to
>provide specifics about the client's environment.

The client's IdP is the one returning the error, not you. They have to
determine why their IdP isn't working and fix their login handler
configuration. Unless you're supplying a setting in the SP to control the
authnContextClassRef used in the request, which I doubt, this isn't
something the SP is causing.

The last two points are *not* things that cause that error, so they are
mistaken. The first issue can, but only if it's set at request time, not
as something you're checking after the fact. So they're 0 for 3.

-- Scott