SP-specific failure to generate 'good' SAML assertion

[Kevin P. Foote]

On Tue, 12 Nov 2013, David Bantz wrote:

> Integrating vendor site and digesting their metadata.  Login attempt at their site successfully re-directs to our IdP and generates required attributes, but fails to produce expected SAML assertion of authN and attributes.
> I see the warning that no attribute can be encoded as NameIdentifier in “required” format; “good” responses to other SPs have messages that no attribute can be encoded as NameIdentifier in “supported” format (not labeled warning).
> I suspect this should tell me something useful, but admit I don’t understand what it’s telling me.  Your help appreciated,

Its pretty much telling you what it says..

The SP is requiring a NameID of type
'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'

And after all the attributes are gathered and format-encoded there are none
left after filtering etc. that can be used as the NameID for the
assertion.

...your filter is probably too tight for that SP...

------
thanks
  kevin.foote