SP-specific failure to generate 'good' SAML assertion

[Cantor, Scott]

On 11/12/13, 12:09 PM, "David Bantz" <dabantz at alaska.edu> wrote:
>
>I see the warning that no attribute can be encoded as NameIdentifier in
>³required² format; ³good² responses to other SPs have messages that no
>attribute can be encoded as NameIdentifier in ³supported² format (not
>labeled warning).

The warning is there because the SP is demanding you give them a transient
ID. If you don't release an attribute with an encoder attached that can
produce that, it can't respond and has to fail the request.

While you can certainly release the necessary attribute, they also very
likely don't *need* a transient ID. Unless you support logout, and they
were using it, there's nothing else a transient NameID will give them. And
in such a case, what they need is *a* NameID, not transient specifically.
So they should not be asking for it.

-- Scott