Single Sign On (SSO) no longer working

[Cantor, Scott]

> I eventually found the problem and it now makes sense.  The work to
> customize the interface had resulted in setting the donotcache flag on
> username/password input.  So that sequence of messages indicates that
> donotcache is set.  Anyway, the problem is fixed.

Hmm. Do you have the initial-authn feature in use? I wouldn't expect it to be able to log a reuse a Password result like that if donotcache were set...even with that feature it seems off to me, but that's the only plausible case I can think of.

> As for Concur, this is a configuration that I inherited which appears to be
> based on an IdP v2 entry in the wiki.  Does someone have a simpler v3
> configuration?  The config I inherited has a few NameID special cases:
> Concur, FieldGlass (using a scoped attribute ID with a SAML1 encoding), and
> Ariba (uppercased username).

It's not a V3 thing, it's just a fact that Concur doesn't care what Format you use in the NameID, so you don't need to use "unspecified".

NameID selection should be driven by metadata when possible, and since you have to invent Concur's metadata locally anyway, you just put NameIDFormat into it with the format you choose to configure. That should never be "unspecified".

In V2 you would still need to override a RP definition to turn encryption off. In V3 you can eliminate that step by making encryption optional with a property and not touch relying-party.xml at all

-- Scott