Shibboleth 代理到 Azure AD 验证错误重定向错误 XML 命名空间 'urn:oasis:names:tc:SAML:2.0:protocol' 中的错误 XML 元素 'RequesterID'

Question

I configured my local shibboleth IdP to proxy authentication to Azure AD but on redirect and getting an Azure error:

AADSTS7500522: XML element 'RequesterID' in XML namespace 'urn:oasis:names:tc:SAML:2.0:protocol' in the SAML message must be a URI.

My service provider that is redirecting to Shibboleth > AzureAD uses an entity ID that is just a name and not a URL which is what shows up in my saml trace back to Azure.

<saml2p:Scoping>
        <saml2p:RequesterID>EntityIDShortName</saml2p:RequesterID>
</saml2p:Scoping>

Is there a way to turn off this validation in Azure or transform / not include the requester id from shibboleth to Azure AD?

I used this document to do the configuration: https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD

Thanks Nick

Answer 1

FYI, just changing the entity I'd in my test provider addresses this issue.