Symptoms

BIG-IP configured as service provider (SP) fails to accept SAML assertion if SAML SLO is configured and subject NameID Format is not specified as part of SAML assertion

Impact

We fail to process the SAML Assertion.

Conditions

When BIG-IP used as SAML Service Provider and SAML Single Logout is configured if the Assertion from IdP (Identity Provider) does not include NameID Format inside SAML Assertion then this condition occurs.

Workaround

Configure SAML IdP such that it always sends NameID Format elememnt inside SAML Assertion.

Fix Information

BIG-IP as SP now accepts SAML assertions even if the NameID Format is missing from the assertion and SAML SLO is configured.

Behavior Change