IDP-initiaded SSO or IdPUnsolicitedSSO

[Peter Schober]

* Jehan Procaccia <Jehan.Procaccia at it-sudparis.eu> [2013-10-16 17:49]:
> 17:25:54.402 - INFO [Shibboleth-Audit:745] - 20131016T152554Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.int-evry.fr/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_5ec2804f8603ecfee1041bbc4c931b17|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|supannEtablissement,transientId,email,|_9a020512fbe201ef30d82a24da0dea2c|_338263ad9f732730c9ccca08d4372a14,|
> 
> looks good so far .

At least your IdP happily sent the data where we said it should (not
knowing whether that's correct in the first place). You really should
ask the SP about the Location where to send assertions and where the
email address should go, and in what format (see below).

> then on their site it fails to login, but it might be because I
> didn't sent them a correct value of attribute for login name
> They told me that they created an account for me  with the ID of my
> email address, I must figure out now a way to send my email as the
> username for that SP ...

According to your IdP audit log you're already releasing a form of
email address as a SAML attribute.
So either
- they did not process your assertion correctly at all, or
- the attribute name and nameFormat did not match what they expect, or
- they expect email to be sent as a NameID, not as an attribute.

While you could spend some time trying to figure all of this out
yourself empirically you really should ask the vendor about all of
this.
-peter