Troubleshooting SAML for ADFS

Updated on

ScreenSteps ADFS Claim Rules

On initial setup, after logging in through ADFS, ScreenSteps was presenting this error:

The status code of the Response was not Success, was Requester
Click to copy

The decoded SAML response (visible using the Chrome SAML Message Decoder plugin) included:

 <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
 <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy" /></samlp:StatusCode>
Click to copy

This was because the nameid format being passed across was unspecified.

To fix this do the following:

1. Create an LDAP claim mapping email address to email address claim type

2. Create a transform rule mapping incoming email to outgoing NameID.

Select the outgoing Name ID format as email.


Claim rule language:

c:[Type == ""]
 => issue(Type = "", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties[""] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");
Click to copy


Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Previous Article SAML Troubleshooting Checklist
Next Article How to Edit Single Sign-on Settings or Find your Consumer URL and Test URL
Still Need Help? Contact Us