<div dir="ltr">I'm obviously missing something triggering "unsupportable identifier format", but haven't been able to spot it; pointers appreciated.<div>
<p class="gmail-p1"><span class="gmail-s1">incoming request:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"...</span><span class="gmail-s1"><br></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"...</span> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1"><br></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span><saml:Issuer><a href="https://integration.oohlalamobile.com/saml/uasitka/metadata">https://integration.oohlalamobile.com/saml/uasitka/metadata</a></saml:Issuer><br></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span><samlp:<b>NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</b></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>AllowCreate="true"</span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>/>...</span><span class="gmail-s1"><br></span><span class="gmail-s1"></samlp:AuthnRequest></span></blockquote>
<p class="gmail-p4">in attribute-resolver:</p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s2"><AttributeDefinition </span><span class="gmail-s3">id</span><span class="gmail-s4">=</span><span class="gmail-s5">"</span><span class="gmail-s6">eduPersonUniqueID</span><span class="gmail-s5">"</span><span class="gmail-s2"> </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s5">"Simple"</span><span class="gmail-s2"> <span class="gmail-Apple-converted-space"> <br></span></span><span class="gmail-s2"> </span><span class="gmail-s3">sourceAttributeID</span><span class="gmail-s4">=</span><span class="gmail-s5">"uakPersonID"</span><span class="gmail-s2">><br></span><span class="gmail-s4"> </span><span class="gmail-s2"><Dependency </span><span class="gmail-s3">ref</span><span class="gmail-s4">=</span><span class="gmail-s5">"uakPersonID"</span><span class="gmail-s2"> /><br></span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeEncoder </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"SAML2ScopedString"</span><span class="gmail-s8"> <br></span><span class="gmail-s8"> </span><span class="gmail-s3">name</span><span class="gmail-s4">=</span><span class="gmail-s2">"urn:oid:1.3.6.1.4.1.5923.1.1.1.13"</span><span class="gmail-s8"> </span><span class="gmail-s3">friendlyName</span><span class="gmail-s4">=</span><span class="gmail-s2">"</span><span class="gmail-s6">eduPersonUniqueID</span><span class="gmail-s2">"</span><span class="gmail-s8">></AttributeEncoder><br></span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeEncoder </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"SAML2StringNameID"<br></span><span class="gmail-s8"> </span><span class="gmail-s3">nameFormat</span><span class="gmail-s4">=</span><span class="gmail-s2">"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</span><span class="gmail-s8"> /><br></span><span class="gmail-s2"></AttributeDefinition></span></blockquote>
<p class="gmail-p7"><span class="gmail-s2"></span></p>
<p class="gmail-p8"><span class="gmail-s2">in attribute-filter:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s2"><AttributeFilterPolicy </span><span class="gmail-s3">id</span><span class="gmail-s4">=</span><span class="gmail-s5">"releaseToOohLaLa"</span><span class="gmail-s2">><br></span><span class="gmail-s4"> </span><span class="gmail-s8"><PolicyRequirementRule </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"Requester"</span><span class="gmail-s8"> </span><span class="gmail-s3">value</span><span class="gmail-s4">=</span><span class="gmail-s2">"<a href="https://integration.oohlalamobile.com/saml/uasitka/metadata">https://integration.oohlalamobile.com/saml/uasitka/metadata</a>"</span><span class="gmail-s8"> /><br></span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeRule </span><span class="gmail-s3">attributeID</span><span class="gmail-s4">=</span><span class="gmail-s5">"</span><span class="gmail-s9">eduPersonUniqueID</span><span class="gmail-s5">"</span><span class="gmail-s8">><br></span><span class="gmail-s4"> </span><span class="gmail-s2"><PermitValueRule </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s5">"ANY"</span><span class="gmail-s2">/><br></span><span class="gmail-s4"> </span><span class="gmail-s2"></AttributeRule></span>...</blockquote>
<p class="gmail-p8"><span class="gmail-s2">in relying-party:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span><bean parent="RelyingPartyByName"<br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span>c:relyingPartyIds="#{{'<a href="https://integration.oohlalamobile.com/saml/uasitka/metadata'}">https://integration.oohlalamobile.com/saml/uasitka/metadata'}</a>}"><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span><property name="profileConfigurations"><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span><list><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span><bean parent="SAML2.SSO"<br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span>p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span></list><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span></property><br></span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span></bean></span></blockquote>
<p class="gmail-p8"><span class="gmail-s2">in the process log:</span></p>
<p class="gmail-p4">11:39:43:908<span class="gmail-Apple-converted-space"> </span>WARN [192.252.140.146] org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337 ><span class="gmail-Apple-converted-space"> </span>Profile Action AddNameIDToSubjects: <b>Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</b></p>
<p class="gmail-p4">11:39:43:909<span class="gmail-Apple-converted-space"> </span>WARN [192.252.140.146] org.opensaml.profile.action.impl.LogEvent:105 ><span class="gmail-Apple-converted-space"> </span>A non-proceed event occurred while processing the request: InvalidNameIDPolicy</p></div></div>