SAML Subject NameIdentifier missing required NameIdentifier value

[Cantor, Scott]

> The IdP however, doesn't redirect back to SP site, and gives the
> following error in the browser:
> 
>          SAML Subject NameIdentifier missing required NameIdentifier value

I think that's exceedingly unlikely. That error is, I think, the one a Shibboleth SP reports when it gets a malformed message (the malformation should be self-explanatory), so I think it has to be returning to the SP site. And the error message format should be entirely clear on that, it should be coming from the SP. If not, I don't really see how that's possible, but I don't understand the uncertainty. You have a browser, so it's telling you where it ended up.

> I am trying to understand where the problem is - on our (SP) side, or on
> IDP side, and if the problem is on our side, then what can we change in
> SP configuration to satisfy this IDP.

If I'm correct, there's nothing you could do, their IdP is broken, and they have to fix it.

-- Scott