title: Issue with SSO between SAML SP and ADFS IdP
body: <p>we are developing a web application which offers multiple login mechanisms such as LDAP, Kerberos, SAP Logon Ticket as well as SAML.</p>
  
  <p>For this we use the Spring Security Framework which works (mostly) fantastic!</p>
  
  <p>A few months ago we added SAML support to our application and tested this with an external IdP (SSOcircle). We also worked closely with CEO of SSOcircle to get us up and running.</p>
  
  <p>Everything worked just fine and we thought we could enroll SAML with our first real life customer.</p>
  
  <p>So we setup a test server (SP) on a linux machine, and configured our part (we used this doc: <a href="http://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-idp-guide.html" rel="nofollow noreferrer">http://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-idp-guide.html</a>) and waited for our customer to do their part.</p>
  
  <p>But when they tried to SSO into our application (they use ADFS), we ran into an issue.</p>
  
  <p>Because right now, we get one out of two error messages. Either this one</p>
  
  <blockquote>
    <p>Authentication request failed:
    org.springframework.security.core.userdetails.UsernameNotFoundException:
    Empty username not allowed!</p>
  </blockquote>
  
  <p>or this one</p>
  
  <blockquote>
    <p>Error validating SAML message org.opensaml.common.SAMLException:
    NameID element must be present as part of the Subject in the Response
    message, please enable it in the IDP configuration</p>
  </blockquote>
  
  <p>During the troubleshooting I came across these other threads here on StackOverflow:</p>
  
  <p><a href="https://stackoverflow.com/questions/26297938/samlexception-nameid-element-must-be-present-as-part-of-the-subject-in-the-resp">SAMLException: NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration</a></p>
  
  <p><a href="https://stackoverflow.com/questions/27130691/configuring-adfs-3-0-saml-2-0-to-work-with-spring-security-for-sso-integration">Configuring ADFS 3.0 / SAML 2.0 to work with Spring Security for SSO integration</a></p>
  
  <p><a href="https://stackoverflow.com/questions/37550777/nameid-element-must-be-present-as-part-of-the-subject">NameID element must be present as part of the Subject</a></p>
  
  <p>The odd thing is, that the second error message (regarding the nameid) element comes up only if we change the adfs claim rule from "Outgoing claim type" to "Pass Through claim type".</p>
  
  <p>Right now, I have no idea where to continue my troubleshooting. Any ideas or thoughts on this issue?</p>
  
  <p>Best regards
  René</p>
  
  <p>EDIT1: I attatched a link to the debug logfile and our saml security config</p>
  
  <p>EDIT2: Does someone know if there is a way to specify a timezone which SAML should use? Right now, Zulu time seems to be the time zone used although our OS is configured to use CET/CEST. Therefore we had to use responseSkew parameters for login/logout.</p>
  
  <p>EDIT3: Debug &amp; Config removed because we solved the problem</p>