We are currently running ADFS on Windows Server 2012 version 6.2 build 9200 and attempting to configure SSO to our Google Apps for Education domain.
I am currently stuck on a Google error, "This account cannot be accessed because the login credentials could not be verified" which is described by Google here,https://support.google.com/a/answer/2463723?hl=en .
Specifically, the requirement is given that:
- If you are using a full email address in your NameID element (you must be if you are using SSO with a multidomain Apps environment), ensure that theFormat attribute of the NameID element specifies that a full email address is to be used, as in the following example:Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email"
In a SAML trace, I show that I am not outputting the NameID in this format, but instead output the following:
<Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user.name@mydomain.net</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="kcdpcdbfpbccffniihhalfchnidmifhpbhjnchkp"
NotOnOrAfter="2014-02-26T19:56:29.445Z"
Recipient="https://www.google.com/a/mydomain.net/acs"
/></SubjectConfirmation></Subject>I assume this is the reason for the error I am receiving and I have deleted and recreated the RP to be certain that I did not select SAML 1.0/1.1 anywhere during the setup. I definitely chose SAML 2.0.
Interestingly, I encountered a comment in the following blog discussing ADFS / Google SSO that describes the exact issue I'm encountering. It is the comment by a poster named Lucas LaCroix about 1/3 of the way down the comments, http://www.huggill.com/2012/01/12/setting-up-google-apps-single-sign-on-sso-with-adfs-2-0-and-a-custom-sts-such-as-identityserver/ .
In the blog the poster mentioned "modifying the transform rule" to resolve this issue, but I have been unable to determine how to do this.
I feel I am very close to completing this configuration and this might be the final step. Can anyone advise me how to troubleshoot this, or how to "modify the transform rule"?