adfs giving error on authnrequest message

Question

I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the authentication (send me a Response message), it succeeds, but when authentication is initiated from my side (sending them an AuthnRequest message), ADFS is erroring.

I'm unable to determine why and not very familiar with ADFS. The error logs provided by the identity provider (anonymized) have this

Verbose,1/25/2019 8:37:10 AM,AD FS Tracing,70,None,"  Message after decoding: <?xml version=""1.0"" standalone=""yes""?>
<samlp:AuthnRequest xmlns:samlp=""urn:oasis:names:tc:SAML:2.0:protocol""
                    xmlns:saml=""urn:oasis:names:tc:SAML:2.0:assertion""
                    Destination=""https://exmaple.com/adfs/ls/""
                    ProviderName=""My SP's human readable name.""
                    AssertionConsumerServiceURL=""https://www.example.com/login/saml2/1234567/authenticate""
                    Version=""2.0""
                    IssueInstant=""2019-01-25T16:37:08Z""
                    ID=""IDcbe874446fa31fcb9c3f5868beab546b"">
  <saml:Issuer>https://www.example.com</saml:Issuer>
  <samlp:NameIDPolicy Format=""transient"" AllowCreate=""1"" />
</samlp:AuthnRequest>"
Error,1/25/2019 8:37:10 AM,AD FS Tracing,153,None,"Exception: MSIS0018: The SAML protocol message cannot be read because it contains data that is not valid.
StackTrace:    at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadNameIDPolicy(XmlReader reader)
   at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadAuthnRequest(XmlReader reader)
   at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadProtocolMessage(String encodedSamlMessage)
   at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.CreateFromNameValueCollection(Uri baseUrl, NameValueCollection collection)
   at Microsoft.IdentityServer.Protocols.Saml.HttpRedirectSamlBindingSerializer.ReadMessage(Uri requestUrl, NameValueCollection form)
   at Microsoft.IdentityServer.Web.Protocols.Saml.HttpSamlMessageFactory.CreateMessage(WrappedHttpListenerRequest httpRequest)
   at Microsoft.IdentityServer.Web.Protocols.Saml.SamlContextFactory.CreateProtocolContextFromRequest(WrappedHttpListenerRequest request, ProtocolContext& protocolContext)
   at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.CreateProtocolContext(WrappedHttpListenerRequest request)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetProtocolHandler(WrappedHttpListenerRequest request, ProtocolContext& protocolContext, PassiveProtocolHandler& protocolHandler)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Exception: Invalid URI: The format of the URI could not be determined.
StackTrace:    at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind)
   at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadNameIDPolicy(XmlReader reader)
"
Error,1/25/2019 8:37:10 AM,AD FS Tracing,87,None,Passive pipeline error

I'm not sure if the two stack traces are different errors, or connected.

My service provider is using a slightly modified version of the Net::SAML2 perl module.

I'm hoping this is just some attribute or element that ADFS is expecting but I am not providing, or better yet, that there's some configuration on their side that is incorrect.

What might cause this error?

Answer 1

I believe we should be sending urn:oasis:names:tc:SAML:2.0:nameid-format:transient instead of transient as the NameIDPolicy Format attribute. Valid values for Format are in section 8.3 of the SAML2 core specification.