InvalidNameIDPolicy occurs when using multi-factor authentication

[Noriyuki TAKEI]

Hi,Nate.

Thanks for your quick reply.

I'm sorry for not understanding "principal" well.

My guess that what "Principal" means is as follows.

Principal identifies a user.A user may have many principals such as mail
address,SNS account and so on.
When not using MFA,principal can be defined automatically.When using X509
process alone,
principal defines common name of certificates.

Is that correct?

if that's correct,how can I define principal in MFA script?

2019年2月4日(月) 8:36 Nate Klingenstein <ndk at signet.id>:

> Noriyuki,
>
> It's not the principal type that's the problem.  It's the actual principal
> name that you're getting out of the authentication process.  It's probably
> different for MFA or Password, and the principal name that you get out of
> MFA process is probably different than the principal name that you're
> getting out of the Password process alone.  This depends totally on how you
> wrote the MFA script.  I believe the log should clearly show the principal
> name that it's using for both LDAP queries, and the Password one
> successfully matches an ImmutableID, and the MFA one doesn't.
>
> Hope this helps,
> Nate.
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
・‥…━━━━━━━━━━━━━━━━━━━━━━━…‥
サイオステクノロジー株式会社
技術部
クラウドソリューショングループ
武井 宜行
〒106-0047  東京都港区南麻布二丁目 12 番 3 号 サイオスビル
TEL：070-6569-1211 (直通) 03-6401-5117 (部代表)
URL：http://www.sios.com/

■SIOSの最新情報はこちらから！「いいね！」をお待ちしています■
(SIOS Technology)：http://www.facebook.com/SIOSTechnology
(OSSよろず相談室)：http://www.facebook.com/OSSyorozu

■Twitter公式アカウント■
https://twitter.com/#!/SIOS_Technology
・‥…━━━━━━━━━━━━━━━━━━━━━━━…‥
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190204/47dc407e/attachment.html>