Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My Service Provider issues a SAML 2.0 AuthRequest with a NameIDPolicy tag like so:

<samlp:NameIDPolicy AllowCreate="true" 
       Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

This causes ADFS 2.0 to correctly issue a SAML Response containing an encrypted NameID token created by a rule similar to the one found here

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">    
        MyeHAMeGLojBt7fcc2DQtntXXFka0kybkR42ZTitTUs=</NameID>

So far so good, however, my Service Provider doesn't seem to understand the encrypted NameID claim and is expecting it to be unencrypted while at the same time having the name-format as transient

As per this document, ADFS2.0 treats request for transient or persistent NameID formats as privacy scenarios (and hence the encryption)

So my question then would be: Is there any way to have ADFS 2.0 generate the NameID claim with Format=transient and an unencrypted NameID like so:

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">Joe</NameID> 
share|improve this question
add comment

2 Answers

The way I've solved this goes like this:

  1. Create a rule that extracts the UPN from AD
  2. Create a transform rule that transforms the Incoming claim type: UPN to the Outgoing claim type: Name ID and choose the transient nameid-format from the 'Outgoing Name ID Format' dropdown

This causes AD to send the NameID in the format required:
<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">Joe</NameID>

(I'll leave this question 'unanswered' for a while incase someone has a better solution.

share|improve this answer
add comment

We had a customer with an issue connecting to our web application. We wanted to disable encryption to help debug what we were receiving. These are the steps they used to disable encryption on their ADFS 2.0 server:

  • Click Start
  • Click Administrative Tools
  • Click Windows PowerShell Modules
  • Then, at the Windows PowerShell command prompt, type the following:

    set-ADFSRelyingPartyTrust –TargetName “target” –EncryptClaims $False
    
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.