InvalidNameIDPolicy occurs when using multi-factor authentication

[Noriyuki TAKEI]

Hi

I'd like to access Office365 by multi-factor authentication.
Office365 requires name-id format
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".

When not using multi-factor authentication(define"idp.authn.flows=
password" in idp.properties),
it works fine.

But when using multi-factor authentication(define"idp.authn.flows= MFA" in
idp.properties),
SAML Response includes error message as described below:

                    <saml2p:Status>
                        <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
                            <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
                        </saml2p:StatusCode>
                        <saml2p:StatusMessage>An error
occurred.</saml2p:StatusMessage>
                    </saml2p:Status>


Do you have any solutions?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190202/4fea77d2/attachment.html>