<div dir="ltr">I&#39;m trying to configure our IdP for an external SP (<a href="http://widencollective.com">widencollective.com</a>).  Authentication is successful (for the user &quot;testuser&quot;) but immediately after that, I get an error page from the SP that states that &quot;the access request was malformed&quot;.  My logs show the following:<div><br></div><div><div>10:59:41.442 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal &#39;testuser&#39; can be encoded in to a NameIdentifier of required format &#39;urn:oasis:names:tc:SAML:2.0:nameid-format:persistent&#39; for relying party &#39;<a href="https://bucknell.widencollective.com">https://bucknell.widencollective.com</a>&#39;</div><div>10:59:41.454 - INFO [Shibboleth-Audit:1028] - 20141009T145941Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4e53a5ba-696d-4e6e-995f-ef4bec816e1b|<a href="https://bucknell.widencollective.com">https://bucknell.widencollective.com</a>|urn:mace:shibboleth:2.0:profiles:saml2:sso|<a href="https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||">https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||</a></div></div><div><br></div><div><br></div><div>In the attribute-filter.xml file, I deny the transientID and provide the attribute cnIdentifiedName, which is an SAML 2.0, persistent nameid attribute:</div><div><br></div><div>I&#39;ve done some research in the Shibboleth Wiki and I keep getting to this page and I have no idea how this relates to my error:</div><div><br></div><div><span style="color:rgb(68,68,68);font-family:tahoma,sans-serif;font-size:13px"> </span><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO" target="_blank" style="font-family:tahoma,sans-serif;font-size:13px">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a><br></div><div><br></div><div>My other option is to use a transient nameid, but I&#39;ve been told that is not supported.</div><div><br></div><div>Any suggestions will be appreciated.</div><div><br></div><div>Thanks,</div><div>Mike</div></div>