Sorry to both of you as I did not have notifications enabled. Yes, I did figure it out. I had tried specifying different name ID format values to no avail. I guess ADFS needs a claim rule transform as it doesn't understand NameIDPolicy. So, if your ADFS counterpart knows what that is, great, they can do something about it. Otherwise, you can set NameIDFormat to null which will cause the following to be sent: <samlp:NameIDPolicy AllowCreate="true" /> which works for them out of the box.
|