Question
Can OneLogin's Ruby gem be configured to return multiple name id formats in our applications saml metadata xml?
Context:
We are a service provider that use's Onelogin's Ruby gem for SAML SSO and we have a customer who is integrating their ADFS 2.0 with our application. We have set this up successfully and have many other customers using ADFS, however, this one customer is running into trouble due to something to do with the nameID format configurations.
When the user gets to the ACS url on our server, we see the error: "The status code of the Response was not Success, was Requester => InvalidNameIDPolicy". In the ADFS Event Log of the customer, we see "Actual NameID properties: null."
We have triple checked that the claims in the customer's Relaying Party Trust are proper with a claim of the AD attribute EmailAddress mapping to an outgoing claim of Email Address and then an additional transform claim of Email Address to outgoing claim of NameID with format Email.
This configuration is consistent with previous customers who haven't had issues and also with the customer's other relaying party trusts which are successfully configured with other service providers.
We looked at other service provider metadata xml and we noticed that they return multiple name id formats. For instance, they have SSO with Zoom and Zoom's metadata xml shows nameid formats for: emailAddress, transient, persistent, unspecified, and X509SubjectName.
My question is: Can OneLogin's Ruby gem be configured to return multiple name id formats in our applications saml metadata xml? There does not appear to be documentation on this via the gem: https://github.com/onelogin/ruby-saml