Displaying the username requested by Microsoft

[Scott Cantor]

> On Mar 24, 2026, at 7:57 AM, Peter Schober via users <users at shibboleth.net> wrote:
> 
> Max Nuding via users <users at shibboleth.net> [2026-03-24 12:17 CET]:
>> For users coming from Microsoft the POST to /idp/profile/SAML2/POST/SSO
>> includes (in addition to the SAMLRequest and RelayState parameters) a
>> "username" parameter. This contains the username which had been entered into
>> the username form from Microsoft.
> 
> Not that this helps you in any way but... isn't that illegal in SAML?

It isn't explicitly precluded, but it's not the intention.

It has to be grabbed during intial contact with an inbound interceptor flow and stashed off in the flow conversation, or ScratchContext. Details of that are beyond the scope of me answering occasional questions here.

Fundamentally, no, it's not how SAML works, and it's not the right way to do this (defining a message extension is).

-- Scott