Join Log in
Score:0
avatar Server

SAML 2.0 NameIDPolicy that was not satisfied by the issued token

cn flag
Chris Lombardi

I am working on a SAML integration with some monitoring software, but I keep receiving the MSIS7070 error below. I have tried numerous transform combinations with no luck. I am certain this is something relatively easy to fix, but my AD FS knowledge is minimal. I am guessing it has something to do with my claim issuance policy? I am trying to send the email address back to the SP. I ensured that the account I am testing with has an email associated with it. Any guidance would be appreciated.

Service provider requirements:

SP specifies urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress for the format of the NameIDPolicy in assertion requests.

Event viewer error

Microsoft.IdentityServer.Protocols.Saml.InvalidNameIdPolicyException: MSIS7070: The SAML request contained a NameIDPolicy that was not satisfied by the issued token. Requested NameIDPolicy: AllowCreate: False Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress SPNameQualifier: . Actual NameID properties: Format: , NameQualifier: SPNameQualifier: , SPProvidedId: .

Rule Language

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = ("urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"), query = ";mail;{0}", param = c.Value);

enter image description here

585
0 + 0
Score:0
avatar Server
cn flag
Chris Lombardi

Got it!

As I suspected it was with my claim issuance policies. What worked for me was the combination of these rules.

Rule 1:

enter image description here

Rule 2 enter image description here

0 + 0
Nazareth Berlanga avatar
in flag
Nazareth Berlanga
This worked for me too. Thanks!
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.