Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

[Peter Schober]

* Pete Scott <PScott at t2systems.com> [2013-06-25 16:58]:
> After the user enters their credentials (note that a (basic auth?)
> dialog box is presented upon navigating to the IdP), they are
> directed back to our SP and presented with the following error.

The IdP can authenticate local subjects any way it wants, incl HTTP
Basic Auth. Uncommon (mostly for bad UX), but valid nonetheless.

> SAML response contained an error
> Error from identity provider:
>     Status: urn:oasis:names:tc:SAML:2.0:status:Responder
>     Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

Well, that just means that.

> The client sent us this:
> The error your side is presenting is typical of an SP that's misconfigured in one of the following ways:
> - It's looking for a  specific AuthnContextClass, specifically PasswordProtectedTransport

Since you did not mention anything in this regardin I'm assuming
you're /not/ in fact requesting a specific AuthnContextClass, so we
can rule that out. Right?

> - The username is expected in the subject instead of the AttributeStatement

Wrong. Their IdP sent an SAML message (note "Error from identity
provider:" above), this has nothing to do with the SP not finding
data.

> - Uid isn't set as the attribute to use for REMOTE_USER

Same as above.

> Thoughts? I can provide more data if asked for it, though I'm
> hesitant to provide specifics about the client's environment.

It's an error message from the IdP. Unless you're in charge of the IdP
and/or the IdP is Shibboleth (were we /could/ engage in speculation
and blackbox debugging) there's not much to go on about.
-peter