diff --git a/modules/saml2/lib/Message.php b/modules/saml2/lib/Message.php index ed71237d1a45177c08e5d25255ec592980b27c89..15a4c2a04fd6944fdb5a5a67157e9239780dcda9 100644 --- a/modules/saml2/lib/Message.php +++ b/modules/saml2/lib/Message.php @@ -347,10 +347,18 @@ class sspmod_saml2_Message { $ar = new SAML2_AuthnRequest(); - $ar->setNameIdPolicy(array( - 'Format' => $spMetadata->getString('NameIDFormat', SAML2_Const::NAMEID_TRANSIENT), - 'AllowCreate' => TRUE, + if ($spMetadata->hasValue('NameIDPolicy')) { + $nameIdPolicy = $spMetadata->getString('NameIDPolicy', NULL); + } else { + $nameIdPolicy = $spMetadata->getString('NameIDFormat', SAML2_Const::NAMEID_TRANSIENT); + } + + if ($nameIdPolicy !== NULL) { + $ar->setNameIdPolicy(array( + 'Format' => $nameIdPolicy, + 'AllowCreate' => TRUE, )); + } $ar->setIssuer($spMetadata->getString('entityid')); $ar->setDestination($idpMetadata->getString('SingleSignOnService'));