Help confirming incorrect SP AuthnRequest value

[Plovich, Tony]

Hello,

The following AuthnRequest is causing my IDP to throw a canonicalization error.  I'm not sure of the exact reason, but based on the spec, it seems like the SP is populating the NameID element with an incorrect value:

<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                    ...
                    >
    ...
    <saml:Subject>
        <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</saml:NameID>
        <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />
    </saml:Subject>
</samlp:AuthnRequest>
>From my reading of the spec, this element should contain the value the SP expects the IDP to resolve for NameID, so "aplovich at anl.gov" in my case.

The spec I'm referencing (pg 49 AuthnRequest, pg 18 Subject): https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf

Is this a correct assessment, or is there something I'm missing?

Thanks,

Tony Plovich
Business Information Systems
Argonne National Laboratory
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220322/2d3edede/attachment.htm>