AttributeValue was not of a supported type and contains no child elements

[Peter Schober]

Hi Jozef,

* Jozef M. <vidiecan at gmail.com> [2014-10-30 15:50]:
> <saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>     <saml:AttributeValue
> xsi:type="xs:string">bc29992aeZZZZZ</saml:AttributeValue>
> </saml:Attribute>

The IDP send an incorrect attribute value, as the value of an
eduPersonTargetedID attribute MUST be a SAML2 NameID, not a string
value.

Point them to the MACE-Dir SAML Attribute Profiles, which are the spec
detailing how you transmit MACE-Dir defined attributs (eduPerson),
http://macedir.org/docs/internet2-mace-dir-saml-attributes-latest.pdf

> If we receive the following everything works as expected
> 
> <saml2:Attribute FriendlyName="eduPersonTargetedID"
> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>     <saml2:AttributeValue>
> <saml2:NameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> NameQualifier="XXX" SPNameQualifier="YYY">ZZZ</saml2:NameID>
>     </saml2:AttributeValue>
> </saml2:Attribute>

That's because in this case the IDP sent a correct attribute value
(though the example above has been botched in the email, as it would
need to be '<saml2:NameID Format=' not '<saml2:NameIDFormat=', see the
closing saml2:NameID tag).

Nothing you can (or should) fix at your end, the IDP sending string
valued attribute values is Doing It Wrong.
-peter