samlp:NameIDPolicy Format attribute is written even if unspecified, causing Azure AD problems
Opened this issue · 2 comments
The NameIDPolicy element and Format attribute are optional as per SAML spec. However, build_request.go always creates them, even if no value has been specified in SAMLServiceProvider.NameIdFormat. This results in a SAML request to the IdP containing:
<samlp:NameIDPolicy AllowCreate="true" Format="" />Azure AD appears to have problems with this, replying with an InvalidNameIDPolicy error and saying
Cannot provide requested name identifier with format for the given subject
(note two spaces between "format" and "for").
I think this is arguably a bug on Azure's part, since the standard says "if no Format value is provided, then the value urn:oasis:names:tc:SAML:1.0:nameid-format:unspecified (see Section 8.3.1) is in effect", and "" isn't a Format value. However, gosaml2's behavior is also a bug, and probably much easier to fix.
There's a PR which attempts to fix this -- #67 -- but I think it would be better to omit only the Format attribute when unspecified, and still allow the IdP to create new IDs.
Hey folks, this would be a really big help to us to get merged-- we're encountering this as well. Anything I can help with?
This PR(#67) has been merged and confirmed that it works with Azure AD.
Would you like to add to the Supported identity providers?
I made PR(#97). Thank you.