SAML SSO logginf with ADFS - InvalidNameIDPolicy

[PawelP]

Hi

We are trying enabling saml sso logging with our ADFS server

We follow meraki documentation and still have some issues

1. When using IDP ( login via our portal) it is working fine
2. When using SP approach - logging via Meraki dashboard 

We receive such error in meraki logs

Assertion validation error: The status code of the Response was not Success, was Requester => InvalidNameIDPolicy

<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
</samlp:StatusCode>
</samlp:Status>

Maybe someone have working solution and can provide detailed configuration on ADFS site
I am sure that issue is somewhere in ADFS configuration but couldnt find where exactly

Regards
Pawel

[alemabrahao]

By default, ADFS sends the NameId format as "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified". You can adjust it. See: https://social.technet.microsoft.com/wiki/contents/articles/4038.ad-fs-2-0-how-to-request-a-specific...

[PawelP]

HI

Thanks for replay

Our admin already found this but so far no luck with setup it correctly

Still searching

[PhilipDAth]

For the love of the networking gods - do you have to use ADFS?  Could you use SAML against AzureAD, Duo, or any other SAML provider?  🙂

ADFS is a dying product, and the less you configure to use it, the less you'll have to migrate later.

[PawelP]

HI

We have tens of portals configured using ADFS and no problem so far

Anyway if Meraki still support it so I think it will not die soon, no oficial announcment found on Microsoft about it

So far it is our standard currently. Question to our admin what they plan for future

Regards

[Fady]

You need to create a transform rule with the below parameters.