SSO with Django 1.9 + djangosaml2 + ADFS 2.0
<p>I'm install and configure ADFS 2.0 as Idp and Django project as SP using djangosaml2. Django project deploing on IIS 7.5.</p>

<p>django saml2 config:</p>

<pre><code>SAML_CONFIG = {
  # full path to the xmlsec1 binary programm
  'xmlsec_binary': 'C:\\Program Files\\xmlsec1\\xmlsec1-1.2.20-win32-x86\\bin\\xmlsec1.exe',

  # your entity id, usually your subdomain plus the url to the metadata view
  'entityid': 'https://sp.corp.com/saml2/metadata/',

  # this block states what services we provide
  'service': {
      # we are just a lonely SP
      'sp' : {
          'authn_requests_signed': "true",
          'name': 'SP',
          'name_id_format': NAMEID_FORMAT_EMAILADDRESS,

          'endpoints': {
              # url and binding to the assetion consumer service view
              # do not change the binding or service name
              'assertion_consumer_service': [
                  ('https://sp.corp.com/saml2/acs/',
                   saml2.BINDING_HTTP_POST),
                  ],
              # url and binding to the single logout service view
              # do not change the binding or service name
              'single_logout_service': [
                  ('https://sp.corp.com/saml2/ls/',
                   saml2.BINDING_HTTP_REDIRECT),
                  ('https://sp.corp.com/saml2/ls/post',
                   saml2.BINDING_HTTP_POST),
                  ],
              },

          # attributes that this project need to identify a user
          'required_attributes': ['email'],

          # attributes that may be useful to have but not required
          'optional_attributes': ['surname'],
          },
      },

  # where the remote metadata is stored
  'metadata': {
      'local': [os.path.join(BASE_DIR, 'FederationMetadata.xml')],
      },

  # set to 1 to output debugging information
  'debug': 1,

  # certificate
  'key_file': os.path.join(BASE_DIR, 'iispk.pem'),  # private part
  'cert_file': os.path.join(BASE_DIR, 'iiscert.pem'),  # public part
  }
</code></pre>

<p>On adfs side add Reling Party Trust via url <a href="https://sp.corp.com/saml2/metadata/" rel="nofollow">https://sp.corp.com/saml2/metadata/</a>. Then add claim rule <strong>Send LDAP attribute as Claim</strong> and add E-Mail-Addressess - Email Address, Surname - surname.
After that go to <a href="https://sp.corp.com/saml2/login/" rel="nofollow">https://sp.corp.com/saml2/login/</a>, enter username and pwd, and get adfs error, which show in Event Log:</p>

<pre><code>Event 364:
Encountered error during federation passive request. 

Additional Data 

Exception details: 
Microsoft.IdentityServer.Protocols.Saml.InvalidNameIdPolicyException: MSIS7012: Ð¾ÑÐ¸Ð±ÐºÐ° Ð¿ÑÐ¸ Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐµ Ð·Ð°Ð¿ÑÐ¾ÑÐ°. ÐÐ»Ñ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð¸Ñ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÑ ÑÐ²ÐµÐ´ÐµÐ½Ð¸Ð¹ Ð¾Ð±ÑÐ°ÑÐ¸ÑÐµÑÑ Ðº Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÑ.
   Ð² Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(HttpSamlRequestMessage httpSamlRequest, SecurityTokenElement onBehalfOf, String&amp; samlpSessionState, String&amp; samlpAuthenticationProvider)
   Ð² Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
   Ð² Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SignIn(SecurityToken securityToken)



Event 321
The SAML authentication request had a NameID Policy that could not be satisfied. 
Requestor: https://iisserver.corp.com/saml2/metadata/ 
Name identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress 
SPNameQualifier:  
Exception details: 
MSIS1000: The SAML request contained a NameIDPolicy that was not satisfied by the issued token. Requested NameIDPolicy: AllowCreate: False Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress SPNameQualifier: . Actual NameID properties: Format: , NameQualifier:  SPNameQualifier: , SPProvidedId: . 

This request failed. 

User Action 
Use the AD FS 2.0 Management snap-in to configure the configuration that emits the required name identifier.
</code></pre>

<p>Tormenting few days. How fix it? It is advisable to detail. Many thanks.</p>

<p>You need to send the NameID claim in the SAML assertion. Since you have not created this claim in the set of issuance rules, ADFS errors saying that the values of cl
aims that it would be minting in the security token does not match the requested policy that you have configured (and sent in the SAML request). </p>

<p>See <a href="https://blogs.msdn.microsoft.com/card/2010/02/17/name-identifiers-in-saml-assertions/" rel="nofollow">https://blogs.msdn.microsoft.com/card/2010/02/17/name-identifiers-in-saml-assertions/</a> for how to generate the NameID claim and the format it should be emitted in. </p>

<p>Thanks //Sam
<strong><em>[Twitter: @MrADFS]</em></strong></p>

python django single-sign-on saml-2.0 adfs2.0