InvalidNameIDPolicy occurs when using multi-factor authentication

[Rod Widdowson]

Did you chase up why this

> [INFO]net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227] - Attribute sources [ImmutableID] did not produce a usable identifier

Happened?  You’ll need a log of the attribute resolution.  My guess would be that the principal is different in the two cases and when you present that to LDAP it doesn’t resolve...

Rod